can a firewall running resolv.conf to resolve externally only be the target of a forwarders directive from a primary internal nameserver? if yes-does a configuration change have to happen? rick