You answered your own question, if you can’t resolve or reach the BES or a Relay, then it won’t connect.
Is the issue DNS where it cannot resolve the FQDN? Can you ping by IP?
To test firewall connectivity, from any client to the BES or Relay, enter the following in a browser. It should immediately return the version of your relay:
If not, then you have an infrastructure issue. You need to place a relay in the DMZ/Cloud with ports open for the clients to reach it. Maybe include a clientsettings.cfg file with the BF Client installer so that you are pointing to a reachable relay instead of the default BES.
Example of a clientsettings.cfg file*:
In addition, Domain (Windows) and Telnet, have nothing to do with BigFix in your example.
*Assumes that after an initial connection is made that a Policy exists to set relay selection to automatic.