Using Network Load Balancer with TCP health check

Summary

Looking for example of TCP health check with network load balancer

Content

I have been exploring the new(er) Network Load Balancer service and am having difficulty preparing even a simple configuration using a TCP health check. While I have been successful with HTTP health checks I'm not yet able to pass a health check using TCP. Consider this example:

• Create NLB with src/dest preservation disabled
• Create Backend Set with dest preservation disabled and TCP health check to port 53
• Create Backend that targets network-accessible DNS server listening on TCP 53

I've tried this simple example more than once but find my Backend never shows healthy. I can hit the backend directly on TCP/53 (using ncat or otherwise) and find the server responds. I am certain there are no missing Security Rules interfering. Also, I have enabled Subnet Logging and see traffic to/from the Backend but the NLS continues to report the Backend is "CRITICAL."