UDP queries time out for some domains from one ISP (AS41676, Poland); TCP works

Hi,

 Since 2026-10-21 (evening, CEST) DNS over UDP to my NextDNS IPv4 endpoints (my dedicated 45.90.28.x / 45.90.30.x addresses) gets no response for some domains when queried from my FTTH connection (ISP:
  JMDI, AS41676, Poland). The same queries over TCP succeed every time. From my second connection (T-Mobile PL, LTE) the same names resolve fine over UDP, and other resolvers (Cloudflare 1.1.1.2) work over
  UDP from the FTTH connection.

  Tested with macOS dig 9.10.6, 10 tries per case, no retries:
  dig +time=2 +tries=1 <domain> @<my-endpoint> +short        # UDP
  dig +tcp +time=2 +tries=1 <domain> @<my-endpoint> +short   # TCP

  ┌─────────────────────┬────────────┬───────┬───────┐
  │      Endpoint       │   Domain   │  UDP  │  TCP  │
  ├─────────────────────┼────────────┼───────┼───────┤
  │ 45.90.28.x          │ google.com │ 9/10  │ 10/10 │
  ├─────────────────────┼────────────┼───────┼───────┤
  │ 45.90.28.x          │ github.com │ 0/10  │ 10/10 │
  ├─────────────────────┼────────────┼───────┼───────┤
  │ 45.90.28.x          │ wp.pl      │ 0/10  │ 10/10 │
  ├─────────────────────┼────────────┼───────┼───────┤
  │ 45.90.30.x          │ google.com │ 10/10 │ 10/10 │
  ├─────────────────────┼────────────┼───────┼───────┤
  │ 45.90.30.x          │ github.com │ 0/10  │ 10/10 │
  ├─────────────────────┼────────────┼───────┼───────┤
  │ 45.90.30.x          │ wp.pl      │ 0/10  │ 10/10 │
  ├─────────────────────┼────────────┼───────┼───────┤
  │ 1.1.1.2 (reference) │ all three  │ 10/10 │ 10/10 │
  └─────────────────────┴────────────┴───────┴───────┘

example.com behaves like github.com (UDP timeout, TCP answers in ~28 ms).

Over UDP, github.com fails in every variant: +noedns, +bufsize=512, +nocookie, +dnssec → 0/5 each. So it doesn't look like EDNS/fragmentation. The failure depends on the queried name and is consistent across random source ports.

Ruled out on my side:
  - no DNS interception on the path (UDP query to 192.0.2.1 gets no answer);
  - whoami.cloudflare CH TXT via 1.1.1.2 shows my real public IP, so no transparent proxy;
  - ICMP to the NextDNS endpoints: 0% loss at the time of the test;
  - my router forwards the queries (NAT sessions are created), but for the failing names no UDP reply comes back.

The evening before, the same connection also had 46–66% ICMP loss to the NextDNS anycast (other destinations 0%), with loss starting in transit after the ISP edge. ICMP has since recovered, the UDP issue hasn't.

Is anyone else on AS41676 seeing this, or is there a known issue with the PoP serving this network? I can share more details with the NextDNS team privately.