Got wierd problem that just started.
Running FC3 with latest bind

DNS is performed externally except a box we have in house. It is this box I am having trouble with.

I have a pix 515e.
The pix has external port
dmz port
internal port

in house dns, mail, and web server are in dmz
all dmz servers have 192.168.x.x ip space

internal ip space is 10.x.x.x

So If Im an outside surfer I plug in web address it hits the outside int and the pix translates it to the dmz using static translations
If Im an internal surfer same thing happens. Basic stuff I know

The Problem lies with my dns
The dns has only a root zone because translations are done externally

In theory I log into server as root perform dig @mail.mydomain.com
It would then contact the rootserver for my domain returning a public address.

Nope it doesnt it returns the internal address (i.e. 192.168.X.X) instead.
but it shows the root dns servers as authority for the domain (This is correct but if it was truly checking the root dns servers it should post the correct external ip for the server)

It does this for the computers on the internal interface as well
If I come in from the external interface it does fine

The resolv.conf has 127.0.0.1 as the nameserver to check since it is a name server. (I have tried changing it to other known good dns servers with the same result)

I have tried changing the hosts file to no avail.
I built a seperate server and the same thing is happening to me on both machines.

Is the mail server broadcasting itself with the 192.168.x.x address
If so how can I bypass that. I have tried editing the host.conf to read bind before hosts but that didnt work either.

I have tried giving the mail server a new 192.X.X.X address but after I restart named and perform the dig command it finds what I changed the mail server to and lists the new 192.168.x.x instead of the external address

If I create a master zone for mydomain.com everything is fixed but I shouldn't have to do this. The root zone should check against the authoritative servers and produce the correct external address. If I bypass the dns server and use the authoritative ones it works but it fails from the server in the dmz.