Well, both dig and nslookup tell me what nameserver I'm getting a reply from. Its from my main AD DNS server. Dig shows the right SOA, but is still coming back with an internal address as an answer.