It can be anything! An apex, subdomain, or even a URL.

Results for*.messaging.vip.symantec.com

Logged At	Not Before	Not After	Common Name	Matching Identities	Issuer Name
2020-01-26T20:06:43.223	2020-01-09T00:00:00	2022-01-08T12:00:00	messaging.vip.symantec.com	*.messaging.vip.symantec.com	C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA
2020-01-26T20:06:43.223	2020-01-09T00:00:00	2022-01-08T12:00:00	messaging.vip.symantec.com	*.messaging.vip.symantec.com	C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA
2020-01-09T20:01:37.676	2020-01-09T00:00:00	2022-01-08T12:00:00	messaging.vip.symantec.com	*.messaging.vip.symantec.com	C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA
2020-01-09T20:01:37.676	2020-01-09T00:00:00	2022-01-08T12:00:00	messaging.vip.symantec.com	*.messaging.vip.symantec.com	C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA