I now switched to forwarding to CZ.nic’s DNS servers. We’ll see if that bug reappears, worst case in some months.
Kresd progressively failing at some point - #5 by iron-maiden describes the same bug, maybe the culprit is a too low default file descriptor limit?