https://pagure.io/fedora-infrastructure/issue/12551

```
$ curl --resolve 'mirrors.fedoraproject.org:443:3.8.95.119' -s -o /dev/null -v 'https://mirrors.fedoraproject.org/metalink?repo=updates-rele
ased-f42&arch=x86_64'

• Added mirrors.fedoraproject.org:443:3.8.95.119 to DNS cache
• Hostname mirrors.fedoraproject.org was found in DNS cache
• Trying 3.8.95.119:443...
• Connected to mirrors.fedoraproject.org (3.8.95.119) port 443
• ALPN: curl offers h2,http/1.1
  } [5 bytes data]
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
  } [512 bytes data]
• CAfile: /etc/pki/tls/certs/ca-bundle.crt
• CApath: none
  { [5 bytes data]
• TLSv1.3 (IN), TLS handshake, Server hello (2):
  { [122 bytes data]
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  { [19 bytes data]
• TLSv1.3 (IN), TLS handshake, Certificate (11):
  { [2789 bytes data]
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
  { [520 bytes data]
• TLSv1.3 (IN), TLS handshake, Finished (20): { [52 bytes data] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): }

  [1 bytes data]

• TLSv1.3 (OUT), TLS handshake, Finished (20):
  } [52 bytes data]
• SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
• ALPN: server accepted h2
• Server certificate:
• subject: C=US; ST=North Carolina; L=Raleigh; O=Red Hat, Inc.; CN=*.fedoraproject.org
• start date: Oct 9 00:00:00 2024 GMT
• expire date: Nov 9 23:59:59 2025 GMT
• subjectAltName: host "mirrors.fedoraproject.org" matched cert's "*.fedoraproject.org"
• issuer: C=US; O=DigiCert Inc; CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1
• SSL certificate verify ok.
• Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using ecdsa-with-SHA384
• Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
• Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
  } [5 bytes data]
• using HTTP/2
• [HTTP/2] [1] OPENED stream for https://mirrors.fedoraproject.org/metalink?repo=updates-released-f42&arch=x86_64
• [HTTP/2] [1] [:method: GET]
• [HTTP/2] [1] [:scheme: https]
• [HTTP/2] [1] [:authority: mirrors.fedoraproject.org]
• [HTTP/2] [1] [:path: /metalink?repo=updates-released-f42&arch=x86_64]
• [HTTP/2] [1] [user-agent: curl/8.9.1]
• [HTTP/2] [1] [accept: */*]
  } [5 bytes data]
  > GET /metalink?repo=updates-released-f42&arch=x86_64 HTTP/2
  > Host: mirrors.fedoraproject.org
  > User-Agent: curl/8.9.1
  > Accept: /
  >
• Request completely sent off
  { [5 bytes data]
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  { [297 bytes data]
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  { [297 bytes data]
  < HTTP/2 404
  < x-frame-options: SAMEORIGIN
  < x-xss-protection: 1; mode=block
  < x-content-type-options: nosniff
  < referrer-policy: same-origin
  < content-type: application/metalink+xml
  < content-length: 126855
  < date: Fri, 09 May 2025 18:18:56 GMT
  < apptime: D=1497
  < x-fedora-proxyserver: proxy35.fedoraproject.org
  < x-fedora-requestid: aB5HEAl2MEtIqvZYGB_DvAAAAQ0
  < server: Apache
  <
  { [16125 bytes data]
• Connection #0 to host mirrors.fedoraproject.org left intact
  ```

All other hosts in the DNS rotation seem to work fine.