Thanks. I suspected that this is where things were heading. I don't see a problem with using hacks-on-hacks to get a thing done with closed systems; one does what one must.

On the DNS end, it seems the constraints are shaped like this:

  1.  Provides custom responses for arbitrary DNS requests, and resolves regular [global] DNS
  2.  Works with residential internet
  3.  Uses no open resolvers (because of amplification attacks)
  4.  Works with standalone [Internet-connected] Nintendo Switch devices
  5.  Avoids VPN (because #4 -- Switch doesn't grok VPN)

With that set of rules, I think the idea is constrained completely out of existence. One or more of them need to be relaxed in order for it to get off the ground.

The most obvious one to relax seems to to be #3, open resolvers. If an open resolver is allowed then the rest of the constraints fit just fine.

DNS amplification can be mitigated well-enough for limited-use things like this Minecraft server in various ways, like implementing per-address rate limiting and denying AXFR completely. These kinds of mitigations can be problematic with popular services, but a handful of Switch devices won't trip over them at all.

Or: VPN could be used. But that will require non-zero hardware for remote players (which can be cheap-ish, but not free), and that hardware will need power, and the software running on that hardware will need configured for each WLAN it is needed to work with. That path is something I wouldn't wish upon a network engineer, much less a kid with a portable game console. It's possible, but it's feels like a complete non-starter.