Oops! "nslookup does use resolv.conf...." "nslookup has to find the SOA record...." That should of course be nsupdate, not nslookup. That's the last time I read my mail first thing in the morning before a cup of coffee.