Safari OCSP/CRL Checking Causing Connectivity Failure
So... There was another thing causing my portal to not load (redirect ACL). The DNS was a red herring, and the only reason we saw AAAA and not A requests was because the machine had already cached the answer for the A record.

Finding that out was humbling... what a silly mistake!

Anyway, no issue with the Mac here, but if you see similar behaviour, flush your DNS cache and try again!