A manual TCP DNS test succeeds but real clients still fail

An operator proves DNS with one command and later finds that the application still cannot resolve names in production.