DNS over TCP passes the manual test but users still fail

An operator proves DNS works with one TCP command and later finds the production application still fails every ordinary lookup.