Windows DNS Server Not Resolving External Names: A Read-First Forwarder, Root Hints, and Recursion Triage

Helpdesk: "Since the firewall cutover on Friday, intranet sites open fine but external sites fail or take ten seconds, and nslookup on a PC says 'DNS request timed out' and then works on the second tr