So we're using Route53 and I wanted to set up a wildcard CNAME record to redirect any unmatched subdomains to our main domain. I tried it out and everything looks like it worked okay, but when I told a colleague about it he was adamently against wildcard CNAME records stating that there are issues/security concerns or something, but wouldn't go into detail. A web search didn't really turn up any explanation for this concern beyond issues isolated to specific DNS server implementations.
That being said are there security issues with wildcard CNAME records? Are there issues with SSL certs if you only have a cert for your top level domain? i.e. Does a CNAME redirect mean that the referrer seen by the server will be the subdomain or the top-level domain? What about cross-origin issues?
He specifically preferred going through the trouble of setting up server at the subdomain that performs a 301 permanent redirect. That seems overly complex when the DNS RFCs 1034 and 2672 describe a mechanism for this and Route53 seems to support this just fine.
If any out there explicitly recommends not setting wildcard CNAME records, can you explain why and under what circumstances you recommend against it?