I worked out this was odd behavior on my OPNSense firewall NAT rules.
For some reason some syncing worked (eg. beehaw.org) but new connections failed. I'm not sure why. Maybe established sessions were kept alive.
Those rules haven't changed in months and months, so I'll chalk that up to "weirdness".
One way is to run Pi-hole’s admin interface on a different port. That’s configured in:
Set:
Then your URL is http://IP:8000/admin