Explanation/Reference:
* You must create a new domain name in Domain Name Services (DNS) to host the apps. To help improve security, the new domain name should not be a subdomain of the domain that hosts the SharePoint sites.
Depending on your configuration, you might have to create a new forward lookup zone first, or you can start with a wildcard CNAME entry in the same zone as the SharePoint site domain.
Note:
To create a wildcard Alias (CNAME) record for the new domain name
1. Verify that the user account that performs this procedure is a local administrator on the domain controller.
2. In DNS Manager, right-click the name of domain that hosts the SharePoint sites, and then click New Alias (CNAME).
3. In the New Resource Record dialog box, in the Alias name (uses parent domain if left blank) box, type *. followed by the domain name that you want to use for apps.
For example, *.ContosoApps.com or *.Contoso-Apps.com.
Etc.
* If you are using Secure Sockets Layer (SSL), you must either create an SSL certificate or add the new domain to your existing SSL certificate.
* Create an SSL certificate if you are using a different root domain (for example, ContosoApps.com).
* Add the new app domain to an existing SSL certificate if you are using the same room domain (for example. Apps.Contoso.com).
Either way, the domain should be added in the form of a wildcard (for example, *.contosoapps.com). You need a wildcard certificate instead of individual certificates because each installed app has its own subdomain.
Note:
* Wildcard DNS should point to the load balancer.
Reference: Deployment Guide for Microsoft SharePoint 2013, Configure an environment for apps