Pasta uses a local resolver right?
We had issues with DNS a while back and ended up with this bodge which might be the issue

networking = {
  # every sever needs to be accessable over ssh for admin use at least
  firewall.allowedTCPPorts = [ 22 ];

  resolvconf.useLocalResolver = false;
  resolvconf.extraConfig = "name_servers='193.1.99.120 193.1.99.109'";
  # explisitly stating this is good
  defaultGateway = {
    address = "193.1.99.65";
    interface = "eth0";
  };

  # cannot use our own it seems?
  nameservers = [
    # ns1
    "193.1.99.120"
    # ns2
    "193.1.99.109"
  ];
};