It's the seperate nameserver and subdomain that I can't quite get my head around - are you saying you can reply to a challenge for x.y.z.org from a nameserver at a.b.c.org?