Unbound timeout resolving Facebook CDN

Having trouble setting up unbound properly in my openwrt router.

Have the basics set up correctly and can resolve most queries, but Facebook CDN addresses fail.

Some queries work:

# nslookup openwrt.org

Name:      openwrt.org
Address 1:
Address 2: 2a03:b0c0:3:d0::1af1:1
# nslookup fbcdn.net

Name:      fbcdn.net
Address 1:
Address 2: 2a03:2880:f119:8083:face:b00c::25de

But Facebook CDN times out:

# nslookup -t120 static.xx.fbcdn.net
;; connection timed out; no servers could be reached

Works fine with Google DNS:

# nslookup static.xx.fbcdn.net

Name:      static.xx.fbcdn.net
static.xx.fbcdn.net     canonical name = scontent.xx.fbcdn.net
Name:      scontent.xx.fbcdn.net
Address 1:
static.xx.fbcdn.net     canonical name = scontent.xx.fbcdn.net
Address 2: 2a03:2880:f019:116:face:b00c::3

I have unbound and dnsmasq configured in parallel, as per https://github.com/openwrt/packages/blob/openwrt-18.06/net/unbound/files/README.md, but I don't think that should affect queries directed directly at unbound on port 53?

I've tried various things like ip4_only, DNSSEC etc. but without knowing exactly what the problem is I don't know where to focus my efforts.

Any pointers on what could be wrong would be much appreciated.

Unbound config:

# uci export unbound
package unbound

config unbound
        option edns_size '1280'
        option extended_luci '0'
        option extended_stats '0'
        option hide_binddata '1'
        option listen_port '53'
        option localservice '1'
        option manual_conf '0'
        option rebind_localhost '0'
        option rebind_protection '1'
        option recursion 'default'
        option resource 'default'
        option root_age '9'
        option ttl_min '120'
        option unbound_control '0'
        option dhcp_link 'dnsmasq'
        option enabled '1'
        option dns64 '0'
        option validator '1'
        option validator_ntp '1'
        option protocol 'mixed'
        list trigger_interface 'lan'
        list trigger_interface 'wan'

Full debug log (unbound -vvv) here: https://pastebin.com/ZuVC18Vk