MME queries to home HSS of visited UE based on its IMSI information. Following is the way to construct FQDN. For the inital request (Authentication-Information-Request ) message, MME does not know which HSS will handle the request but it know at least which network need to be contacted.
Destination Realm: epc.mcc<>.mnc<>.3gppnetwork.org
Source Host: mmec2.mmegi1.mme.epc.mcc<>.mnc<>.3gppnetwork.og
Hope you understood now. If you still need any clarification then please ping me.
