My first guess would be that the domain uses a custom nameserver that logs all dns queries and serves back a different IP to each user. Then when the http request comes in to that specific IP, it can check the dns logs to identify the resolver.

But surely.. that would either require (a) a massive IP space (i guess that works if the site is IPv6 only), or (b) assuming a pretty short time between dns lookup and http request, and hence possibly false results if the dns lookup is cached somewhere and the IP has since been reused

I'd love to know if there's a better way of implementing this.