I spent much of the past couple of days running down what I thought was a VLAN trunking issue due to mixing and matching Unifi and Mikrotik gear and moving things around, but it turned out to just be that I forgot that I had adjusted the firewall rules for the VLAN, and that I had neglected to allow DHCP+DNS to the gateway from that untrusted VLAN. I very rarely touch the firewall so I'd forgotten that I'd done that about a week or so earlier.