Re: Determining case of REFUSED queries

173.245.59.231 is a cloudflare name server. I get this: dig ns socialinnovation.ca ; <<>> DiG 9.16.50-Debian <<>> ns socialinnovation.ca ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29081 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITI

Re: My Introduction and current issues -

I noted that it appears your internal network is 123.123.123.0/24.  This ip range is assigned globally to a Chinese ISP.  This may not be a good idea. I agree that using forwarding is not necessary and may introduce some issues. And yes, you need to stop using nslookup and use dig instead.