Interestingly enough, Plex is running something very similar to this to support SSL for all of their users. a-b-c-d.guid.plex.direct will resolve to a.b.c.d. (Where guid is replaced with a guid, without dashes.)