Thank you very much for your response, Simon.
That makes sense, and confirms my assumption (and fills in the bits I was
missing!).
Your suggestion to talk directly to the authoritative server is definitely
correct, I was just trying not modify our legacy systems too much. We have a
few old scr
# My zones and their subnets
auth-zone=mobile-test.example.ru
auth-zone=ns1.mobile-test.example.ru
# SOA config
auth-soa=2018101101,mobile-test.example.ru,120,120,604800
# Slave NS: nameserver2.provider.com (50.60.70.80)
# Secondary NS (slave NS at IT)
auth-sec-servers=msk-dc1.example.ru
auth-se