Question: I have public DNS for company domain (`example.org`, for example) on DNS hosting service. And I have local DNS server (BIND) in office which forwards public DNS. In office I have servers which provide services (web, mail, etc) in public domain and also have local IP addresses.

I want to give access for public domain from office throught local IP addresses of servers. 

For example. In public DNS I have A record `mail.example.org -> 110.28.34.48`, which should be translated in local DNS to `mail.example.org -> 192.168.15.2`. I.e. when client from office will request IP for `mail.example.org`, local DNS server (BIND) will request this from public DNS and replace IP in answer if this IP in special list (list of servers public IPs with local IPs).

Is there any way to replace IP in DNS answer for several IPs in BIND server?

The best way is to replace exactly IP in answer and not to generate public zones for local IPs on local DNS.

Answer: 
You would need at least a /28 prefix mask for the IP on eth0 in order to be in the same subnet with the default gateway (for the scenario you described with gateway on .10).
Change the netmask of eth0 to 255.255.255.240, see if you can ping the default gateway, then you can add any further IP addresses to that device with a /32 prefix (255.255.255.255) without issues.
As stated in the question, the method of accessing the default gateway is not via a broadcast domain, each IP address should be host-only, and so having a 32 bit mask.

Access to the gateway is via two static route entries. The first is a host route to describe the interface the gateway is out of, and the second is to define the default route as that gateway.

There is not need for less than 32bit netmasks if you are explicit about the location of the gateway in the routing table.

The issue here is that the netmask was not specified for the sub interfaces, and so defaulted to /24. This meant that while the eth0 interface was 32bit, and effectively not connected to an IP network, the eth0:1 interface was in 10.1.1.0/24 and therefore a connected interface to the network the gateway IP resided. The connected interface route took precedence over the static route, and so was selected as the source IP address.

As stated in the question, the masks need to be 32bit for the behaviour to be as desired, so the answer was to change the netmask to 32bit for the subinterface. Once this happened, the only route available was the default route, to the gateway with its own host route defined.

For those unfamiliar with why this setup is used, it is used where you want flexibility with IP address allocation and conservation. There is no need to carve up the address space into subnets with this method, though it does come with administrative overheads. As stated, the environment isn't under the control of the questioner.