Route53 Resolution Incorrect Against Various Servers Across The Internet

Question

We host DNS with Route53. One specific record has come in to question after much confusion and investigation as to why we were having intermittent problems with it. The record is plesk.magicalproductions.net and the set IP is 149.28.66.164. However, when using various tools to check propagation on this hostname several servers across the internet come back with various random/different IP addresses. For example, https://www.whatsmydns.net/#A/plesk.magicalproductions.net will show 1-3 servers responding with the wrong IP address. I've manually run dig against some of these servers and sure enough the response is either random or incorrect.

I have verified a few things... one, the domain is using our name servers (ns1 and ns2 dot magical.ws) and those name servers are set properly under the magical.ws zone along with properly using delegation sets and having the correct lookups for ns1 and ns2 set within that zone.

I contacted Plesk, the company who handles the software which we use for hosting and this domain, and they alerted me to the DNS issue. I contacted our hosting company (Vultr) just now, although I can't see how this would be their issue since we host all of our DNS with Route53. The only thing I can deduce is somehow those other servers are getting a record which is wrong. I don't know how those random DNS servers would otherwise reply with the wrong IP. I've checked everything I can in Route53 and see no issue.

I don't know how I would go about further resolving this without someone from AWS being able to see why this is happening. We have hosted our DNS with Route53 for several years, this only recently started happening. I randomly pulled a few zones over the CLI and they all have the proper delegation setup, so othewise I see no resolution.

Answer

Here's an example. I have a recurring test hitting Google DNS (https://dns.google/resolve?name=plesk.magicalproductions.net&type=A) and when the IP is incorrect I log it. This has happened consistently over the last hour at least 20 times. Here is one of the responses that failed, which I don't begin to understand:

{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"plesk.magicalproductions.net.","type":1}],"Answer":[{"name":"plesk.magicalproductions.net.","type":1,"TTL":60,"data":"50.116.16.111"}],"Comment":"Response from ns2.magical.ws.(50.116.16.111)."}

You can see the response is the same as the name server IP that it pulled from. That IP is not related to us in any way. It's not ns2.magical.ws and it's not plesk.magicalproductions.net. So, where did Google choose to query that name server from? Even if a root server was giving back bad info about the authoritative owner of the domain, why would the response be incorrect? (and the same IP as the A record response, for that matter)

Here is a valid response: 
{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"plesk.magicalproductions.net.","type":1}],"Answer":[{"name":"plesk.magicalproductions.net.","type":1,"TTL":3600,"data":"149.28.66.164"}],"Comment":"Response from ns3.magcal.ws.(205.251.198.208)."}

Route53 Resolution Incorrect Against Various Servers Across The Internet

Relevant content