You deploy an Ingress resource that routes traffic for the host 'shop.example.com' to a Service named 'storefront'. The NGINX Ingress controller is running with a valid external IP and the 'storefront' Service has healthy endpoints. A user reports that requests to 'shop.example.com' work correctly, but requests sent to the controller's external IP using a host header of 'unknown.example.com' return a generic 404 from the ingress controller rather than a connection error. Your team wants requests that match no configured host/path rule to be served by a custom maintenance Service instead of the controller's built-in 404 page. What is the correct way to achieve this?