I had no time to debug the issue yet -- as usual, issues comes in batches, you discover somethin does not work when trying to fix something else (and so on)... ;) It seems that upgrading to 1.3.1 from 1.3.0 breaks root forward zone. Ie, if there's a zone declaration forward-zone: name: "." forward-address: 1.2.3.4 this declaration is ignored and normal way to resolve, using usual set of root nameservers, is used instead. Reverting back to 1.3.0 fixes it. Maybe it's my build somehow, I don't yet know -- today was a difficult day for me :) JFYI. I'll try to debug it further tomorrow. /mjt