Resolução de DNS para alguns domínios falham mas funciona o dig + tcp

Question

Na minha conexão de internet doméstica, posso resolver a maioria dos domínios, mas nenhum dos subdomínios do cloudfront.net resolve.

$ dig @8.8.8.8 resolver-identity.cloudfront.net

; <<>> DiG 9.9.5-3-Ubuntu <<>> @8.8.8.8 resolver-identity.cloudfront.net
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

No entanto, posso resolvê-lo no TCP.

$ dig @8.8.8.8 resolver-identity.cloudfront.net +tcp

; <<>> DiG 9.9.5-3-Ubuntu <<>> @8.8.8.8 resolver-identity.cloudfront.net +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21121
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;resolver-identity.cloudfront.net. IN   A

;; ANSWER SECTION:
resolver-identity.cloudfront.net. 9 IN  A   74.125.190.147

;; Query time: 46 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jun 30 11:26:14 IST 2014
;; MSG SIZE  rcvd: 77

O que poderia dar errado? Como pode contornar isso?