DNS – Point a Subdomain with CNAME to a DDNS Subdomain

This is a grossly-simplified explanation, but what you want to do cannot be achieved without changing ports on the outside because the firewall that's in front of your 3 servers doesn't "care" what the hostname is; it only cares about IP addresses and ports and as such has no way of knowing what server it is that you want to connect to.

Now if you can burn a couple of extra public IP addresses, you can do 1:1 NAT (sometimes called "DMZ mode") so that server1, server2, server3 effectively have their own public IP addresses and then you can create server1.example.com to resolve to server1's NAT'ed public IP address and so on.

There might be an SSH daemon or reverse proxy out there that "understands" the SSH protocol enough to do this by hostname, but my guess is not (and perhaps someone well-versed in the SSH v2 protocol can elaborate).

This is not a DNS problem.

You have to tell the web server at address XXX.XXX.XXX.XXX how to handle requests for cdn.xyz.com. See your web server's documentation for (name-based) virtual hosting.

If you are using Apache: http://httpd.apache.org/docs/current/vhosts/name-based.html