How do debug DNS name resolution? (nslookup works, but telnet doesn't)

DNS resolution does not automatically mean HTTP reachability; in your case, that is in fact part of the problem.

sixxs.org answers all DNS queries with a CNAME to ipv6.nginx.sixxs.net. As an example, iamugly obviously couldn't be a real site, since there is no top-level domain.

[mpenning@Bucksnort ~]$ dig +short iamugly.sixxs.org
ipv6.nginx.sixxs.net.
[mpenning@Bucksnort ~]$ dig +short google.com.sixxs.org
ipv6.nginx.sixxs.net.
[mpenning@Bucksnort ~]$ dig google.com.sixxs.org

; <<>> DiG 9.7.3 <<>> google.com.sixxs.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22229
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.sixxs.org.          IN      A

;; ANSWER SECTION:
google.com.sixxs.org.   3553    IN      CNAME   ipv6.nginx.sixxs.net.

;; AUTHORITY SECTION:
sixxs.net.              3316    IN      SOA     ns.paphosting.net. hostmaster.sixxs.net. 2012010601 86400 7200 1209600 86400

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon May 28 15:39:58 2012
;; MSG SIZE  rcvd: 133

[mpenning@Bucksnort ~]$

ipv6.nginx.sixxs.net is just an HTTP proxy that forwards traffic, so as long as their proxy is up, it is ping-able and you can telnet to it...

[mpenning@Bucksnort ~]$ telnet superuser.com.sixxs.org 80
Trying 2620:0:6b0:a:250:56ff:fe99:78f7...
Connected to ipv6.nginx.sixxs.net.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
[mpenning@Bucksnort ~]$

After you go to superuser.com.sixxs.org, sixxs.net redirects you through ipv6gate.sixxs.net and they rewrite Super User's html content send all links on the page through foo.sixxs.org.

Something is preventing you from going through sixxs.org, and it probably comes from a vpn server, firewall or transparent http proxy elsewhere in your path.

Here is my guess about what is going.

(I was originally going to post this as a comment, but its too long, so I will post it as an answer and leave it up to yourself and/or others to decide if it is correct.)

I think this isp have their nameservers configured to reply to every subdomain.

I tried a random GUID and yes 0937c1fa-15dc-4a3a-837c-b9ada0953a7e.sixxs.org resolves (and to the same ip addresses as superuser.com.sixxs.org)

This means all traffic to 0937c1fa-15dc-4a3a-837c-b9ada0953a7e.sixxs.org will be sent to them. When it gets to them, they are probably examining the http host header to determine how to handle it. In the case of 0937c1fa-15dc-4a3a-837c-b9ada0953a7e.sixxs.org, I would suspect they would simply ignore the request as they are unlikely to know what to do with it.

In the case of superuser.com.sixxs.org, you would think that they should be redirecting this to superuser.com which but this does not appear to work.

I don't think it is possible for anyone outside their setup to know for sure why this does not work, but it could be because they have some internal mapping wrong and it is sending to the wrong destination.

Another possibility is that they may not be providing this service to everyone and it is possible that if a non-subscriber attempts to use this address, it will simply ignore the request.

Bottom line is, I'm not really sure whether telnet, Chrome and Internet Explorer are actually doing anything wrong and I would suggest checking with sixxs.net before assuming there is anything wrong with your setup.