Damn it, it was Suricata! ssid 2027757 block dns to .to domains... It always is what you never think of