Struggling to do anything with docker.io

I've recently had to commission a new NAS and I am running into a problem with docker. The logins, pulls, or runs I do fail with:

Unable to find image 'nginx:latest' locally docker: Error response from daemon: Get "https://registry-1.docker.io/v2/": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers). See 'docker run --help'.

The only way I can get it to work is if I change /etc/resolv.conf to use google nameservers, but that's just a bandage. On my local network I've whitelisted every docker domain I could find.

download.docker.com
registry-1.docker.io
production.cloudfare.docker.com
index.docker.io

Here's nslookup https://registry-1.docker.io

;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; no servers could be reached

Here's sudo resolvectl status:

Global
       Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported resolv.conf mode: stub

Link 2 (eno1) Current Scopes: DNS
     Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported    DNS Servers: 192.168.9.1
    DNS Domain: LeveNet

Link 3 (eno2) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 4 (docker0) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 7 (br-9e6a1065404c) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 43 (vethb895f20) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 45 (vethe54eaf2) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 47 (veth20ea475) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 59 (veth8c0dc14) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 75 (veth3089223) Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

What's strange here is that even when I point the router to use google DNS, the server still fails to work with docker.io. The ONLY bandaid that works is when I change resolv.conf.

I don't pretend network guru and I just don't know how to fix this permanently without affecting other things that run just fine. This problem is absolutely exclusive to this NAS - as far as I can tell every other system on the network has zero issues working with docker.io. How do I fix this?