Quoting Joachim Fahrner (jf@???):

> Looks like that solved it. Same problem is described here:
> https://serverfault.com/questions/405650/why-are-these-udp-packets-being-dropped

Glad to hear it!

> But shouldn't DNSSEC use tcp instead of udp?

Only if the response is larger than the maximum UDP size.
https://serverfault.com/questions/404840/when-do-dns-queries-use-tcp-instead-of-udp