Note the size of your ENDS udp
packet vs mine. It could be the Sophos as well but I'd assume there would be logs showing the udp
packet oversize drop.
Edit:
Yours
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
Mine
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096