Ping and curl resolve to one IP, dig/nslookup/host resolve to another
And I found it. The VPN config was auto-configuring it's own DNS servers, which were overriding my setup, because the VPN was also telling it to look up hosts in the domain that I was overriding. This caused the Directory Services to use the VPN vended DNS servers. 

To fix, I added my custom DNS server as the first lookup entry under the VPN DNS config, and that worked.