I can't see any successful lookups over DNS in the log you shared.
The text output from tcpdump doesn't normally include enough information for diagnosis. In general it's better to look at the raw dump:
tcpdump -i any udp port 53 -s65535 -wtcpdump.pcap
Then open tcpdump.pcap in something like Wireshark.
However, I think I see the problem. The queries in the log look rather odd:
14:34:01.876591 IP dhpc01.cs.deu.edu.tr.27170 > tnz1030.tinaztepe.deu.edu.tr.domain: 40676+ A? M-bM-^@M-^\es2M-bM-^@M-^]. (27)
Here's what a normal query looks like on my laptop:
11:59:17.368076 IP 192.168.1.179.51532 > 192.168.1.12.53: 3345+ A? es1. (21)
Note all that extra junk M-bM-^@M-^\ that shouldn't be there. I looked more closely at your config file and it seems you have so-called "smart" quotes there:
discovery.zen.ping.unicast.hosts: [“es1” , “es2”, “es3” , “es4” , “es5” , “es6” , “es7” , “es8” , “es9” , “es10” , “es11” , “es12” , “es13” , “es14” , “es15” , “es16”]
Compare this to a correctly-formatted file:
discovery.zen.ping.unicast.hosts: ["es1" , "es2", "es3" , "es4" , "es5" , "es6" , "es7" , "es8" , "es9" , "es10" , "es11" , "es12" , "es13" , "es14" , "es15" , "es16"]
Note the subtly different quotation marks. Try fixing that.
I also note that you have discovery.zen.minimum_master_nodes: 3. This is appropriate for clusters with 4 or 5 master-eligible nodes. How many of your nodes are master-eligible? Normally you'd only list the master-eligible nodes in discovery.zen.ping.unicast.hosts, but you have listed 16 there. If you have 16 master-eligible nodes then discovery.zen.minimum_master_nodes should be set to 9.