I added my findings to this thread: https://forums.developer.apple.com/thread/47315
In short, even in iOS 10, it appears that the wildcard setup requires that the apple-app-site-association file be served by the wildcard’s root.
For instance, if you want to use *.domain.com, then the apple-app-site-association needs to be hosted at both, e.g., app1.domain.com and domain.com, else it won’t work with simply specifying applinks:*.domain.com in Xcode.
This is unfortunate if your main site is hosted at www.domain.com, and that you have a 301 redirect on domain.com (which redirects you to www.domain.com), because Universal Links do not allow redirects.
The workaround I found was to create a main subdomain for your app, and to use sub-subdomains for the wildcard. E.g.
app.domain.com(must serve theapple-app-site-associationfile)server1.app.domain.com(must serve theapple-app-site-association)server2.app.domain.com(…)
That way, in Xcode, you may only specify applinks:*.app.domain.com and Universal Links will work without you having to specify server1.app.domain.com, server2.app.domain.com, and so on… in Xcode.
Note, however, that you must also explicitly specify applinks:app.domain.com if you plan on using that server as well with your app.
I hope this helps.