I've run into resolvers that filter things like that to prevent dns rebinding attacks. And localhost (the hostname) does not work for CORS.

Best option is probably to set dev.our-root-domain.com in /etc/hosts

[1]: https://en.wikipedia.org/wiki/DNS_rebinding

Haven't had an issue yet, with a team scattered across US, Canada and UK. I'm sure it's possible - but so far we've been using this for about 3 years with no hiccups.