Not sure if it fits in your setup, but I’m accomplishing what you’re looking for (myservice.mydomain.com) with self-hosted AdGuard and DNS rewrites (send URL X to IP Y), and then just point the router to AdGuard DNS.

The few services I need to access from outside my home LAN run through Tailscale on my laptop or phone, so no services are publicly exposed.