Wouldn't that have also worked with a wildcard DNS? Then, no need for an external DNS service. Although less secure (filter would be on ingress, not in DNS resolving).
In my point of view, it's a security risk and a bad practice, that's why I prefer this way even if a bit complicated (not that much when everything is setup)