I discovered that the Drupal module wasn't caching any resolveDomain responses. It comes down to these lines in Symfony's cache library:

\Symfony\Component\Cache\Adapter\AbstractAdapter::save:

    public function save(CacheItemInterface $item)
    {
        if (!$item instanceof \Symfony\Component\Cache\CacheItem) {
            return false;
        }

At first, I thought this was an obvious bug - why force a specific concrete implementation? Git led me to this issue and comment thread:

symfony/symfony#17408 (diff)

In other words, what Symfony is doing is OK by the spec (though confusing PHP-wise). CacheItems should only be created by calling get() on the cache adapter, which ensures it's a compatible object.