Probably the federation is still trying to access matrix.example.com instead of just example.com to get the .well-known configuration.
I’m not sure how to make this work in general, you need a way for the federated instances to ask your instance for the configuration in the host you want.