Well, I'm just throwing out something to check, but I meant on the server, not the client. It's trying to resolve "localhost" to check the auth. If there's a delay, that's probably where it is.
I guess I just assumed that's where you were testing dig.
Yep. my mistake. i did not read it correctly. in order to discard the rule, it first has to find out by expanding the hosts in the rule, so yep, dns resolution might be the problem.
also, the 4-5s delay is eerie similar to issues in the past.