I have also been doing a little more playing - the issue might just be that the destination nameservers (for mail.protection.outlook.com) don't support EDNS. If I do a query with EDNS disabled, I do get answers - so for outlook.com the problem might be more technical, rather than policy.
In general, all DNS queries munnari sends use EDNS. kre
