Try running provision with the following /etc/hosts file:
127.0.0.2 aragon.example.com aragon
172.16.10.30 aragon.example.com aragon
Then take a look at the zone file that is generated. The host IP is 127.0.0.2.
The provision script could instead refuse IP 127.* that resolves to the
hostname, then check for a valid network IP. If it can not find it, do
a DNS lookup; if that fails, bomb-out with an appropriate message.
Exactly this issue I pointed out nearly two years ago and abartlet told me that I have to live with this since the provision can't distinguish between the various IPs and simply takes the first one. To workaround this issue use the "--host-ip" option of the provision script.
*** This bug has been marked as a duplicate of bug 5484 ***