Thanks for your reply.

> Are you sure that firewalls/NATs on the way are configured correctly?

Actually no, not completely sure ...

> What happen when you try "dig @ ns" ? ( is address
> of A root server)

; <<>> DiG 9.3.4-P1 <<>> @ ns
; (1 server found)
;; global options: printcmd
;; connection timed out; no servers could be reached

I can ping though ...

As I said, if I add:
forwarders {;; };
forward only;
to my named.conf, I can dig, but "dig @ ns" still

I'm confused.

Ian Masters