NPM can also do URL proxying: you can reach sub.maindomain.com
at maindomain.com/whatever/
. Edit the proxy host definition for the main domain and look in the "custom locations" tab.
Alternatively, if you can control your browser's settings, you can try using DNS over HTTPS which can let you bypass your company's DNS. Try using https://dns.quad9.net/dns-query
for example as the DNS over HTTPS address (or whatever your browser can offer).