Probably no need to guess at all. If it's given a domain, it can perform a DNS lookup for the domain - if its A entry matches, it can tunnel to the IP that the respective AAAA points to. Clever.