DOH! - I forgot - I was experimenting with a new filter, to block all the junk packets from UDP 53 to 1026/1027 - the damn thing took the first bit, and missed the second.
So. NO DNS lookup, and forcing a proxy by IP address (not name!) means you don't NEED DNS.
Only this morning, did I realize it felt like a DNS lookup problem.
I was going to note the proxy, but I can't see an IP address indication anywhere.
I'm not sure what logic they spread the proxies with, but each proxy of the set serves a particular range of sites - maybe just by IP address, maybe geographic, or maybe something clever like spreading the busiest sites across all the proxies .... NAH! - it's NTL, after all
That's why when one proxy goes down (and you're NOT forcing), only some sites are down - in this case, what was up were the ones already in my local DNS cache before the filter foulup.