A DNS resolver cluster still answers while one firewall update blocks only the TCP fallback path for large DNSSEC-signed replies during a failover rehearsal

Most lookups work and the larger signed ones expose the hidden protocol gap. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.