I’ve spoken with a colleague who’s more experienced with physical networking (my work is mostly cloud based) and it seems the issue is that i have a dumb switch in-between my server and my managed router/switch so nothing is crossing VLANs properly. We figured this out because I did a packet capture on my network and did two DNS queries, one from my machine on my VPN network to the DNS server and one from the docker container to the DNS server. Both sent the same query except my machine got a response and the container did not. I am a bit skeptical that it’s purely a VLAN issue, but this DNS server hasn’t had any other issues with other subnets that aren’t dealing with VLANs so when you’ve eliminated the impossible all that remains is the improbable.