How are subdomain resolved

When someone queries a non-existent domain name, the reply that it does not exists (NXDOMAIN), cached in the intermediate DNS servers.

Possibly for dev.domain.com, negative reply was cached somewhere.

To test, try

1. nslookup dev.domain.com (or dig dev.domain.com)
2. nslookup dev.domain.com ns1.domain.com (or dig @ns1.domain.com dev.domain.com)

If that is the case, you'll get negative answer in 1. and your IP in 2.

There's no solution other to wait the time specified in the last field of your SOA record (nslookup -type=SOA domain.com or dig domain.com SOA). To prevent it in the future, put there some lower value.

As for login.domain.com - it falls back to the first VirtualHost defined. It is normal behavior.

(I'd agree that if you would post the real domain name, it would make our life better)

I've looked this up before, but I'm having trouble finding something better than this at the moment: https://lists.isc.org/pipermail/bind-users/2012-April/087455.html

BIND8 and onward consider each of the forwarders begin with "equal weight". Based on the SRTT of the responses, the nameserver begins to favor one over the other. A certain percentage of queries will always hit the one with higher latency, to retest the waters and keep the calculated weight preference fair. (bearing in mind that once a record is cached, the forwarders will not be consulted for it again until the TTL has expired)

In short, the forwarders directive is designed with redundancy and minimized latency in mind -- not in an active-standby failover model. This will not do what you want it to, and I am not aware of any BIND directives to reconfigure this behavior. I end up staring at BIND documentation a fair bit in my line of work so I feel pretty confident about this statement.