Dry run successful but production run fails with same args (--expand)

Yes, I think it is probably the same thing as the previous thread, where some of the VA IP addresses were getting into /etc/hosts.deny somehow.