For #3, are you limiting yourself to the case where Bob has his own domain name that points to the service, or something else? One workaround is to do the redirects at the HTTP level, not the DNS (cname) level. I'm not arguing the overall decision, just trying to make sure I understand the requirements.