A manual DNS test succeeds over TCP but real clients still fail

An operator proves DNS with one command and later finds the application still cannot resolve names in production.