I might have a solution, but it requires another computer....
In the windows server world, the "domain.com" is considered a PDC(Primary Domain Controller) a server that x and x domain for services...
You will need two machines! A PDC and the HFS server machine at download.domain.com
so your current website will be on one server the PDC "domain.com " and the HFS server will connect to the PDC and you can nat traffic on the local network so the HFS server talks to and works only for domain.com .... Thereby giving you download.domain.com not accessible via the web except through domain.com and tunneling....
that the only solution that comes to mind... good luck
exaple picture of a server setup via domains:
http://programming4.us/image/062011/Understanding%20Networking_2.jpg