The example of this I'm looking at right now is 'tiles.wmflabs.org'. I've set up a by-hand entry right now, but perhaps the proxy panel should handle it.
Ordinarily a record like 'foo.wmflabs.org' would be on the domain 'wmflabs.org'. In the case of tiles.wmflabs.org, though, the domain 'tiles.wmflabs.org' also exists. In that case, apparently the record 'tiles.wmflabs.org' needs to belong to the subdomain 'tiles.wmflabs.org' -- if it belongs to wmflabs.org it doesn't resolve.
So, I guess this is yet another special case that the proxy panel needs to handle :(