I worked out this was odd behavior on my OPNSense firewall NAT rules.
For some reason some syncing worked (eg. beehaw.org) but new connections failed. I’m not sure why. Maybe established sessions were kept alive.
Those rules haven’t changed in months and months, so I’ll chalk that up to “weirdness”.
One way is to run Pi-hole’s admin interface on a different port. That’s configured in:
Set:
server.port := 8000
Then your URL is http://IP:8000/admin