FYI, this is called “split horizon” DNS, where the location you get directed is based on the network you adk from. Make sure you have short TTLs set on your DNS records, or devices can have problems moving between networks and still having records cached from the prior network

For the $5 first payment, they have a partnership with Snikket who will setup and administer a private XMPP server for you. It’s included in the price if service and is retained for as long as you maintain a server. You can use it for any XMPP thing you want, and have as many users on it as you want.

Privacy friendly Ente has an E2EE cloud backed up authenticator app called Auth. In case you didn’t want to host your own, or need multi-device sync.

Or you can just self host Bitwarden and use the built in 2FA that can be attached to any login