Interestingly, it's the .xyz on our VM domain that causes problems. It's apparently far more of a problematic gTLD than I realized. E.g. it appears Southwest Airlines blocks the entire thing, as do some enterprise networks are working with.

(We have a fix for this coming in a few weeks.)