I already tried using multiple resolvers (the config above is my minimal test config), using just the IPv6 CF resolver, as well as disabling DNSSEC completely. While there might be some differences in the delay between these config (it's not always easy to measure this), it remains way to high...