Where does email sent to *example.com go?

The answer is incomplete. It has no MX record but it does have an A record which is used as a fallback. The A record for example.com/net/org resolves to the private IP address 192.168.43.10, which is where your MTA will attempt to deliver it.

So if you want to receive incoming emails without changing the DNS resolution for the example domains, setup a mail server on your local network using that IP address and you'll be RFC compliant and still get the email.

Someone wondered about this in another HN thread (which is what led to this question being asked), and personally I find it astonishing that there's a bunch of hackers here that don't know how email works or what an MX record is.

I guess in this age of Amazon this and cloud that, nobody bothers to learn how these things work as long as they can run their webscale node app written in CoffeeScript on their cloud servers.

The top-voted answer is wrong. If there's no MX record, mail servers will attempt deliver to the A record.

example.com's servers don't listen on port 25, so the mail server won't establish a TCP connection and won't even begin delivery.

I tried to amend the answer on stackoverflow but I don't have an account and it needs to be "peer reviewed" or something.

example.com is protected by RFC 2606 ("Reserved Top Level DNS Names") for special use (with example.org and example.net - along the same lines as the reservation for 127/24, 192.168/16, etc).

The domain is owned by ICANN and has no MX record. Where the mail goes depends on your site-local MTA configuration. On the public internet it goes (or should go) nowhere and bounce back immediately with an appropriate status code from your provider's MTA.