It’s funny, when you explain it, my IT hat goes on and I totally get it lol. I guess the context felt different enough that I didn’t get it. But I work with Windows domains all day and that’s exactly how DNS operates in that environment.
Ultimately I think for a tunnel you’ll end up with your records pointing to your VPS. So you’ll have a *.domain.tld CNAME record and maybe a @ CNAME record and your nginx server on the other end of the tunnel would handle the routing.