Intermitting problems with resolutions in caching name server

[Ganniterix]

Hi all. Hope someone can enlighten me. I have a strange problem with
my caching name server, and I have run out of ideas on where to debug
next. Basically my BIND server decides on it's own which names to
resolve and which not. For example ...

[root at server named]# dig +trace www.google.com

; <<>> DiG 9.5.1b3-RedHat-9.5.1-0.9.b3.fc10 <<>> +trace www.google.com
;; global options:  printcmd
.                       518400  IN      NS      L.ROOT-SERVERS.NET.
.                       518400  IN      NS      C.ROOT-SERVERS.NET.
.                       518400  IN      NS      H.ROOT-SERVERS.NET.
.                       518400  IN      NS      I.ROOT-SERVERS.NET.
.                       518400  IN      NS      G.ROOT-SERVERS.NET.
.                       518400  IN      NS      B.ROOT-SERVERS.NET.
.                       518400  IN      NS      E.ROOT-SERVERS.NET.
.                       518400  IN      NS      J.ROOT-SERVERS.NET.
.                       518400  IN      NS      M.ROOT-SERVERS.NET.
.                       518400  IN      NS      K.ROOT-SERVERS.NET.
.                       518400  IN      NS      A.ROOT-SERVERS.NET.
.                       518400  IN      NS      D.ROOT-SERVERS.NET.
.                       518400  IN      NS      F.ROOT-SERVERS.NET.
;; Received 288 bytes from 172.16.0.1#53(172.16.0.1) in 1 ms

www.google.com.         397954  IN      CNAME   www.l.google.com.
www.l.google.com.       3       IN      A       209.85.135.104
www.l.google.com.       3       IN      A       209.85.135.147
www.l.google.com.       3       IN      A       209.85.135.99
www.l.google.com.       3       IN      A       209.85.135.103
l.google.com.           52352   IN      NS      b.l.google.com.
l.google.com.           52352   IN      NS      c.l.google.com.
l.google.com.           52352   IN      NS      d.l.google.com.
l.google.com.           52352   IN      NS      e.l.google.com.
l.google.com.           52352   IN      NS      f.l.google.com.
l.google.com.           52352   IN      NS      g.l.google.com.
l.google.com.           52352   IN      NS      a.l.google.com.
;; Received 340 bytes from 202.12.27.33#53(M.ROOT-SERVERS.NET) in 102
ms

.... this works!! But this ...

[root at server named]# dig +trace www.redhat.com

; <<>> DiG 9.5.1b3-RedHat-9.5.1-0.9.b3.fc10 <<>> +trace www.redhat.com
;; global options:  printcmd
.                       518400  IN      NS      H.ROOT-SERVERS.NET.
.                       518400  IN      NS      D.ROOT-SERVERS.NET.
.                       518400  IN      NS      E.ROOT-SERVERS.NET.
.                       518400  IN      NS      B.ROOT-SERVERS.NET.
.                       518400  IN      NS      L.ROOT-SERVERS.NET.
.                       518400  IN      NS      K.ROOT-SERVERS.NET.
.                       518400  IN      NS      G.ROOT-SERVERS.NET.
.                       518400  IN      NS      C.ROOT-SERVERS.NET.
.                       518400  IN      NS      J.ROOT-SERVERS.NET.
.                       518400  IN      NS      F.ROOT-SERVERS.NET.
.                       518400  IN      NS      A.ROOT-SERVERS.NET.
.                       518400  IN      NS      M.ROOT-SERVERS.NET.
.                       518400  IN      NS      I.ROOT-SERVERS.NET.
;; Received 228 bytes from 172.16.0.1#53(172.16.0.1) in 1 ms

redhat.com.             126692  IN      NS      ns1.redhat.com.
redhat.com.             126692  IN      NS      ns2.redhat.com.
redhat.com.             126692  IN      NS      ns3.redhat.com.
;; Received 134 bytes from 128.8.10.90#53(D.ROOT-SERVERS.NET) in 105
ms

redhat.com.             126681  IN      NS      ns2.redhat.com.
redhat.com.             126681  IN      NS      ns3.redhat.com.
redhat.com.             126681  IN      NS      ns1.redhat.com.
;; BAD (HORIZONTAL) REFERRAL
;; Received 134 bytes from 66.187.224.210#53(ns2.redhat.com) in 16662
ms

does not.

My base OS is Fedora Core 10, version of bind is 9.5.1. The
configuration file in use is :

options {
        directory "/var/named";
        dump-file "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        recursion yes;
        allow-query {
                localhost;
                172.16/16;
        };
        listen-on port 53 {
                127.0.0.1;
                172.16.0.1;
        };
        memstatistics-file "/var/named/data/named_mem_stats.txt";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };

        category lame-servers {
                null;
        };
};

zone "0.0.127.in-addr.arpa" {
        type master;
        file "named.loopback";
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/rndc.key";

My server is running behind the NAT firewall.

Any suggestions where to continue?