FQDN Security Policy Problem (A-Records missing from lookup)

So, i tried to make a FQDN security policy to allow one of our servers to fetch owncloud updates.

The policy looks like this

xxx@yyy> show configuration security policies from-zone perimeter1 to-zone untrust policy allow-http-owncloud
match {
    source-address degent-net;
    destination-address [ download.owncloud.org apps.owncloud.com www.owncloud.org github.com github-cloud.s3.amazonaws.com ];
    application [ junos-http junos-https junos-ftp ];
}
then {
    permit;
}


xxx@yyy> show configuration security address-book global address github-cloud.s3.amazonaws.com
dns-name github-cloud.s3.amazonaws.com;

this yields:

xxx@yyy> show security policies policy-name allow-http-owncloud detail
Policy: allow-http-owncloud, action-type: permit, State: enabled, Index: 45, Scope Policy: 0
  Policy Type: Configured
  Sequence number: 3
  From zone: perimeter1, To zone: untrust
  Source addresses:
    degent-net(global): 123.123.123.123/32
  Destination addresses:
    github-cloud.s3.amazonaws.com(global): 54.231.80.224/32
    github.com(global): 192.30.252.130/32
    www.owncloud.org(global): 50.30.33.236/32
    apps.owncloud.com(global): 85.25.74.45/32
    download.owncloud.org(global): 188.40.68.177/32
    download.owncloud.org(global): 148.251.209.106/32
    download.owncloud.org(global): 213.239.207.26/32
    download.owncloud.org(global): 188.40.127.122/32
    download.owncloud.org(global): 144.76.105.220/32
  Application: junos-http
    IP protocol: tcp, ALG: http, Inactivity timeout: 300
      Source port range: [0-0]
      Destination port range: [80-80]
  Application: junos-https
    IP protocol: tcp, ALG: 0, Inactivity timeout: 1800
      Source port range: [0-0]
      Destination port range: [443-443]
  Application: junos-ftp
    IP protocol: tcp, ALG: ftp, Inactivity timeout: 1800
      Source port range: [0-0]
      Destination port range: [21-21]
  Per policy TCP Options: SYN check: No, SEQ check: No

now the problem is:

xxx@yyy> show security dns-cache dns-name github-cloud.s3.amazonaws.com
DNS Name: github-cloud.s3.amazonaws.com
  Address Family: IPv4, TTL: 0
    IP Address: 54.231.11.80

while in fact:

xxx@yyy:~$ for i in {1..10}; do host github-cloud.s3.amazonaws.com; done
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.48.168
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.13.233
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.12.137
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.114.162
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.13.233
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.13.233
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.13.233
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.12.137
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.13.233
github-cloud.s3.amazonaws.com is an alias for s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com has address 54.231.13.233

So ... Except for whitelisting everything that is returned by https://ip-ranges.amazonaws.com/ip-ranges.json , what are my options?