[Question] Translating public DNS to internal DNS without revealing the internal DNS

So I’ve got a Consul cluster running for service discovery on a set of servers, some of which have public IP addresses. On some of these nodes I want to run Traefik (dynamically registered), which are registered on tfk.service.consul which holds a number of A and AAAA records. I want my address tfk.example.com to point at those A-records without revealing the consul address.

How would I do this?

Example:

Some application maps internal A-records to public A-records.

<span style="color:#323232;">public             | internal               / xxx.xxx.xxx.xxx
</span><span style="color:#323232;">tfk.example.com -- | -- tfk.service.consul -- yyy.yyy.yyy.yyy
</span><span style="color:#323232;">                   |                         zzz.zzz.zzz.zzz
</span>

Expected result:

Public DNS resolvers never see the consul query.

<span style="color:#323232;">public           / xxx.xxx.xxx.xxx
</span><span style="color:#323232;">tfk.example.com -- yyy.yyy.yyy.yyy
</span><span style="color:#323232;">                  zzz.zzz.zzz.zzz
</span>

I know I could use consul-template for this purpose by rendering config files to bind or similar, but I was wondering if there was some way to do this via DNS like some kind of bridge application.