Technically William is right, and only letters, numbers and hyphen (-) are allowed in subdomains.
However: in practice, you will see that underscore (_) will also work in all major browsers, but this is not guaranteed. Some providers and other services may not allow you to set it in DNS.
If you set a wildcard in DNS it will resolve, then then it is up to the actual application to take it or ignore it.
Ironically, the other answers to this questions are correct answers to the question "what are the legal characters for a hostname or primary domain", while the answers to the question "can (hostname) subdomains have an underscore" are correct answers to this question.
For non-IDN domain names, the allowed characters per
RFC 1035 are:
a-z
A-Z
0-9
-
. – if part of a subdomain
Here's the full definition:
<domain> ::= <subdomain> | " "
<subdomain> ::= <label> | <subdomain> "." <label>
<label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]
<ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
<let-dig-hyp> ::= <let-dig> | "-"
<let-dig> ::= <letter> | <digit>
<letter> ::= any one of the 52 alphabetic characters A through Z in upper case and a through z in lower case
<digit> ::= any one of the ten digits 0 through 9
Specifically regarding upper/lower, domain names are case-insensitive. Here's a bit from RFC 1035 about that:
Note that while upper and lower case letters are allowed in domain names, no significance is attached to the case. That is, two names with the same spelling but different case are to be treated as if identical.
This answer addresses what is allowed for non-IDN domain names, and does not define behavior for a web browser, client application, or application server. If you've set up a wildcard (*) to route traffic somewhere, it's possible for a subdomain to contain characters beyond the set of a-zA-Z0-9-..