@alatlantic Did you try connected to the Deco, but with another local IP for your PC?

  @yves_b thanks, yea I've tried about everything but not troubleshooting the PC itself -if I make NextDNS the DNS servers of the Deco itself, no device on the network (phones, chromebooks, pc) can resolve said domain names.   I only turned to doing digs for troubleshooting purposes after the problem arose.  Would be nice if anyone else who has these devices could attempt said lookups and report back - would be a huge clue whether it's the ISP or the router.

  @alatlantic 

"if I make NextDNS the DNS servers of the Deco itself, no device on the network (phones, chromebooks, pc) can resolve said domain names"

I assume this is only when your devices use the Deco as DNS, or use NextDNS as DNS, as told via DHCP by the Deco.

"If I go modem -> PC, the problem goes away."

I assume that the external IP is identical to the usage of modem -- Deco -- PC.
The problem goes away, even when forcing usage of IPv4 for the DNS query?

Did you try querying the ipv6 addresses of NextDNS?

  @yves_b 

Correct on all counts.

If I enabled IPv6 on the router, and query via IPv6, it works fine.  DoT and DoH also work fine.  This is constrained to the IPv4 address and certain query domains, oddly enough.

  @yves_b 

Also adding - it's not just NextDNS, but also a lot of smaller DNS resolvers AND the auth servers for the query domain(slack) themselves.

It almost feels like the logic is...if it's a DNS packet, and contains some data I don't like(unsure if it's IP or Name), block it unless it comes from a well known DNS resolver.

  @alatlantic 

I am not convinced it makes sense, but I was wondering if some DNS servers were blocking your public IPv4 address, not answering DNS requests coming from your IPv4 public address.

I am unable to accept that the Deco would somehow block some DNS requests or responses.

Just my feeling...

  @yves_b 

Well, unfortunately that would have been easier.  These DNS servers answer queries for other domains just fine.

It's very strange because it's not an IP filter, because most queries work fine.  And it's not a content filter, because Google and Quad9 responses work fine.  It's some strange combination of the two, and honestly I've never encountered anything like it.

Thanks for the suggestions, by the way.