An HTTP redirect is a completely different thing from a CNAME record in the DNS. If you visit https://onion.nytimes.com/ https://onion.nytimes.com/ and it send

An HTTP redirect is a completely different thing from a CNAME record in the DNS. If you visit https://onion.nytimes.com/ https://onion.nytimes.com/ and it sends you a 301 redirect to https://nytimes3xbfgragh.onion/ https://nytimes3xbfgragh.onion/ then yes, I'm pretty sure that'd work fine. However, if you perform a DNS lookup on `onion.nytimes.com` and receive in response a CNAME record pointing to `nytimes3xbfgragh.onion`, I seriously doubt the browser is going to respond to that by establishing a new Tor circuit to the named hidden service. Rather, it's most likely just going to do what every other DNS client does when it receives a CNAME record; it'll try to look up `nytimes3xbfgragh.onion` in the DNS. (And fail, because `.onion` is not a valid TLD in the regular DNS system.)