CoreDNS wildcard for iamworkin.lan catches unresolved names and returns the Traefik VIP (10.0.56.200), so downloads.asterisk.org from inside a pod returns 404 from Traefik rather than the real Sangoma mirror. Pin the real IP (165.22.184.19 = oss-downloads.sangoma.com) via hostAliases so curl reaches the actual server. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>