FWIW the intermittent problem I was experiencing with TDE DNS was mine.
We only use ipv4. We therefore had "-4" in /etc/default/bind9.
Probably during the latest Debian upgrade the appropriate file had become /etc/default/named but I had not added "-4" in /etc/default/named.
Fixed here now. Sorry for the noise.
--Mike