While the he.net app is normally very good, I've found a bug in the DNS troubleshooting section.
When encountering an error, it reports "Server rejected query", without telling us which server rejected the query, or what the nature was of the rejection.
Without knowing the server's IP address, this is impossible to troubleshoot.
This would be the DNS server you're querying, and if you didn't enter one in the tool, it would be the default DNS server for your phone, which should then be displayed as placeholder text in the DNS server field.
If you're trying to query an authoritative DNS server for a domain it does not handle, this is the response you will receive. A few other rare cases it's a non-recoverable error on the remote server, or it has no answer to give you, and doesn't want to return NXDOMAIN instead for some reason.