How do you construct a practical full-domain hash function? I am looking for practical constructions for Full Domain Hash.

I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a technicality", but it's unclear whether that is producing a full domain hash, or just ensuring the message is well-formed using an existing hash function.

I haven't found any other information regarding full domain hash constructions.
I don't know if that counts, but authors of recently selected SHA3 function Keccak mention its ability to perform Full Domain Hashing:


  Variable output length hashing is an interesting feature for natively supporting a wide range of applications including full domain hashing [...]