Identify whether you are diagnosing a recursive resolver, an authoritative server or the network between them. Record the server address, queried name/type and observed failure. Make firewall changes only on infrastructure you are authorised to administer.

1. Run the same DNS query over the usual UDP path and explicitly over TCP. Query the actual affected nameserver or resolver so results are comparable.
2. Inspect a UDP response for truncation. A truncated answer can instruct a client to retry over TCP, so successful receipt of that small response does not prove the lookup can finish.
3. On the DNS server, verify that the daemon listens on both protocols and the correct public IPv4/IPv6 interfaces. Check local firewall and upstream security-group rules separately.
4. Permit the necessary DNS TCP traffic for the server's role without opening recursive service to unauthorised clients. Public authoritative service and public recursive access are different policies.
5. Retest from an external network and inspect relevant logs. Keep security controls for transfers and administration separate from normal TCP query access.

dig @ns1.example.net example.com SOA +tcp
dig @ns1.example.net example.com DNSKEY +dnssec +tcp

Replace example names and documentation addresses with the exact authorised service details. These commands query existing configuration; they do not change DNS.

Both a small ordinary query and a larger relevant query should succeed over TCP. Confirm routine resolution, DNSSEC validation where used, and access from every advertised address family.

If TCP connects but a query is refused, inspect DNS service policy rather than only the firewall. If TCP times out, compare listener, routing and packet-filter evidence before changing the DNS records themselves.

• Investigate DNS answers that fail on one network but work elsewhere
• Diagnose DNSSEC validation failures that appear as SERVFAIL
• Diagnose a listed nameserver that does not serve the delegated zone
• Query authoritative nameservers directly when diagnosing DNS

• RFC 7766
• BIND 9: dig reference