A diagram of the relevant Hypervisor/VMs/containers + Network information would be helpful.

From where and how are you testing DNS? Did you use dig and specified the nameserver directly?

Zyxel AX7501 has one sfp+ 10G wan and one rj45 10G lan port. Should be around 350$ if you can buy it where you live. I work at an ISP am that's the device we're giving to our customers for 10G.

In general I don't think you'll get much lower than that even if you build your own router.