Ok, I've found the problem, but I have no idea why it causes this symptom.

Dipsy is my primary DNS server. Just over a year ago Dipsy was moved from connecting via one ISP to another, so its IP addresses changed.

Dipsy's /etc/resolv.conf contains three nameserver directives, the first is its own IP address. The other two are the ISPs two DNS servers.

I had forgotten to update resolv.conf after the ISP move, so the first nameserver directive was Dipsy's old now useless IP address.

For reasons that I don't understand this causes Dipsy to ignore 80% of the ping replies from Vault (even though tcpdump shows them arriving).

If I remove the bad nameserver from resolv.conf or put the correct IP address in the pings go back to normal.

I didn't believe this to start with, but I have verified that this is the case.

I don't understand...

P.S. in both cases dig returns the correct IP address for Vault