I worked out this was odd behavior on my OPNSense firewall NAT rules.
For some reason some syncing worked (eg. beehaw.org) but new connections failed. I'm not sure why. Maybe established sessions were kept alive.
Those rules haven't changed in months and months, so I'll chalk that up to "weirdness".