DNS AXFR's for DNSSEC signed zones are failing when transfered over the WAN with "Unable to AXFR zone '[domain.tld]' from remote '[Primary NS IP]' (resolver): Timeout while reading data from remote nameserver over TCP"

1. Firewalling and Software is ruled out.
2. All AXFR's work over LAN.
3. Non DNSSEC AXFR's work over WAN
4. No NAT is involved

Anyone had relevant experience to assist please?