tips on debugging DNS

[Kimi Ostro]

Hi bind-users@,
Does any one know of any tips/tools to aid in debugging DNS?

My problem is that internal name resolution works fine. Anything
beyond is not working at all.

my two internal name servers' forward any none local queries to a
caching resolver only name server. nothing in the logs seems to
suggest anything, tcdump turns up nothing although both dig & host get
a REFUSED.

first thought was the firewall but I disabled that and still the
problem persists, I can ping the outside world with ip addresses but
not domain/host names/

I've attached my configs.

I'm running BIND 9.4.1 under a jail on FreeBSD RELENG_7
Copyright (c) 1992-2007 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 7.0-CURRENT #0: Sat Sep 15 20:08:34 BST 2007
    root at base.karomuta.org:/usr/obj/usr/src/sys/NARMER
ACPI APIC Table: <COMPAQ BROOKDG >
Timecounter "i8254" frequency 1193185 Hz quality 0
CPU: Intel(R) Pentium(R) 4 CPU 1400MHz (1395.10-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf0a  Stepping = 10
  Features=0x3febfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM>
real memory  = 1602224128 (1528 MB)
avail memory = 1560711168 (1488 MB)

thank you for your patience
-- 
Kimi