This probably isn't the right place to ask this question but;
1) Subdomains
I'd imagine they just have a wildcard subdomain. If you run the dig
tool you get a response like this;
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5 <<>> test.wordpress.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62954
;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;test.wordpress.com. IN A
;; ANSWER SECTION:
test.wordpress.com. 14400 IN CNAME lb.wordpress.com.
lb.wordpress.com. 300 IN A 76.74.254.120
lb.wordpress.com. 300 IN A 76.74.254.123
lb.wordpress.com. 300 IN A 72.233.2.58
lb.wordpress.com. 300 IN A 72.233.69.6
lb.wordpress.com. 300 IN A 74.200.243.251
lb.wordpress.com. 300 IN A 74.200.244.59
;; Query time: 237 msec
;; SERVER: 192.168.16.103#53(192.168.16.103)
;; WHEN: Mon Nov 21 10:27:33 2011
;; MSG SIZE rcvd: 149
That's a bit of a mouth-full, but here's a basic breakdown;
test.wordpress.com. 14400 IN CNAME lb.wordpress.com.
test.wordpress.com, or any subdomain of wordpress.com, is a CNAME to lb.wordpress.com (I assume 'lb' is 'load balancer'). lb.wordpress.com contains some A records that point to their servers. On the server side, they most likely have the configuration set so *.wordpress.com CNAME's to lb.wordpress.com, then when they need to add/remove/modify servers they can change the settings for lb.wordpress.com.
2) Custom domains.
This is really more of an application side issue, every* HTTP request sends a HTTP header containing the host. This can be accessed from the application, for example in PHP you can get this value with $_SERVER['HTTP_HOST']
. Then it's simply a matter of looking up which 'user' a HTTP host belongs too and returning the content. To understand this a bit more I'd suggest you look into the way Wordpress MU, Wordpress Networks (MU was 'discontinued'/it was integrated into the core of Wordpress standard) and the 'Wordpress MU Domain Mapping' plugin work.
*Most, in fact you can pretty much depend on the Host: header being sent. Any client that doesn't send Host headers will likely run into many other issues.