So - some fiddling - I can see a DNS redirect message in the live log but ... no DNS data gets returned. Rolled back to 27.1 and all works perfectly. My setup is a transparent bridge if that makes any difference on an APU3-4. I reviewed the rules etc as indicated above but no luck. Rules are all migrated to the "new" rules format on 27.1.x and they work.
"