A manual LiveUpdate that is run from the SEP client GUI tries to resolve liveupdate.symantec.com (even if it isn't in the LU server list) and if it can't resolve then the session fails despite other choices in the server list. This has been fixed in Symantec Endpoint Protection version 12.1 RU5.
Upgrade to Symantec Endpoint Protection version 12.1 RU5 for Macintosh.
Provide name resolution for liveupdate.symantec.com.
Rely on a scheduled LiveUpdate -- it doesn't check liveupdate.symantec.com unless it's in the server list and if it doesn't resolve then LU tries the next one in the list.