We had an instance where we wanted to host an application over Incapsula, that was on a sub-domain (ie: portal.domain.com).
The DNS hosting was done completely in Amazon Route53. The procedure to get it setup was a bit tricky, since Incapsula only provides you a CNAME record if you are just hosting a sub-domain. Since hosted sub-domain record sets cannot contain root CNAMEs (portal.domain.com), there is a bit of a dns shuffle that needs to occur to getting this to work.