Search paths. The full address is go.corp.google.com (which is simply a URL shortener), IIRC; however, I think the resolvers are also configured to respond to a bare name in a lot of cases as an optimization. They talk a little bit about corp in their BeyondCorp paper[0], which is well worth a read, and I'm speaking to ancient memory so I might be wrong these days.
By default foo resolves to foo.mydomain.mytld (man resolv.conf, section domain), so as long as the machines are configured with a local domain, this will work.
It works the same as any other corporate network: either custom DNS resolution on the machine (i.e. /etc/hosts), DNS resolution in the internal network, or DNS resolution on the VPN. Or, more likely, a mix of the 3.
To get to go links, you've got to be connected to Google's network (either physically, or through VPN). It's essentially the same as accessing a computer on your LAN with its host name (in which case, the router can do the DNS lookup and resolution for the internal network).
Fascinating but totally incorrect analysis. All anyone needs to get to go/ is to put corp.google.com in their resolver search paths. Of course, such people will also need a google.com login to actually be redirected to the destination.
[0]: http://static.googleusercontent.com/media/research.google.co...