When a user adds a domain to the Approved Senders in Email Impersonation Control, an email coming from a subdomain of that entry is still caught by Email Impersonation Control ( EIC ).
Email Impersonation Control
The Approved Senders lists for Anti-Spam and Email Impersonation Control (EIC) are distinct and operate independently. While adding a domain to the Anti-Spam Approved Sender list will also approve any subdomains of the listed domain; the EIC Approved Senders list only approves the parent domain and not its subdomains.
Email Impersonation Control service uses exact match for the Envelope Sender domain. If you also want to approve its subdomains, then you have to add another entire by using wildcard.
Here's an example explanation: