Attaching a firewall to a droplet slows down DNS resolution by 2 seconds

I recently noticed that running git on my server became a lot slower. I timed the time it takes to resolve github.com and this is the result:

$ time dig github.com +short
140.82.121.3

real    0m2.011s
user    0m0.011s
sys     0m0.005s

Over 2 seconds! When I removed my droplet from the firewall, the result was dramatically different:

$ time dig github.com +short
140.82.121.3

real    0m0.013s
user    0m0.008s
sys     0m0.004s

Here’s the configuration of my firewall:

Why is that happening?