iptables stopped translating DNS packets?

# iptables -t nat -S
...
-A PREROUTING -d 217.xxxx/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.x.x.9
-A PREROUTING -d 217.xxxx/32 -p udp -m udp --dport 53 -j DNAT --to-destination 10.x.x.9
...
# iptables -S
...
-A FORWARD -i eth0 -j ETH0-IN
-A ETH0-IN -d 10.x.x.9/32 -p tcp -m tcp --dport 53 -j ACCEPT
-A ETH0-IN -d 10.x.x.9/32 -p udp -m udp --dport 53 -j ACCEPT

Running iptables -t nat -nvL shows zeroes at these NAT translation rules. WTF?! It worked before some kernel or iptables update, but since some time the DNS server behind this firewall just stays inaccessible. Verified by iptables -A INPUT -d 217.xxxx -p udp --dport 53 -j LOG, logs do come in with untranslated packets. OS CentOS7, uname -a here:

Linux fwxxxx 3.10.0-862.9.1.el7.x86_64 #1 SMP Mon Jul 16 16:29:36 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

firewalld is explicitly removed from this machine. No rules are configured in mangle or raw tables, nothing elsewhere. I'm frankly baffled. Is this a known bug?