Local BIND DNS Caching server clients not resolving public DNS, only internal zone

There are a bunch of commented sections to give an idea of what I’ve tried. Note, this is getting copied in as a jinja2 template via an ansible playbook (that’s why there is an ansible variable in there). This is on a CentOS 8 server running BIND 9.11.13 in a master/slave configuration. The DNS servers themselves are supposed to be internal only caching DNS servers and have no problem resolving anything public or private. However clients end up only resolving the local zone. Here is the named.conf from the master:

//
// named.conf
//

/*
acl "trusted" {
        10.0.0.10; #ns1
        10.0.0.11; #ns2
        10.0.0.0/24;
};
*/

options {
        listen-on port 53 { 127.0.0.1; {{ ansible_default_ipv4.address }}; }
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        secroots-file   "/var/named/data/named.secroots";
        recursing-file  "/var/named/data/named.recursing";
        allow-query     { any; };

        recursion yes;
        
        dnssec-enable no;
        dnssec-validation no;
        dnssec-lookaside auto;

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";

        /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
        include "/etc/crypto-policies/back-ends/bind.config";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

/*
zone "." {
        type forward;
        forward only;
        forwarders { 8.8.8.8; 8.8.4.4; };
};
*/

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

// forward lookup zone
zone "domain.local" {
     type master;
     file "domain.local.db";
     allow-update { none; };
     allow-query { any; };
     allow-transfer  { 10.0.0.11; };
     also-notify { 10.0.0.11; };
     notify yes;
};

// reverse lookup zone
zone "0.0.10.in-addr.arpa" {
     type master;
     file "domain.local.rev";
     allow-update { none; };
     allow-query { any; };
     allow-transfer  { 10.0.0.11; };
     also-notify { 10.0.0.11; };
     notify yes;
};

As you can see I am back to pretty much vanilla settings. I tried a bunch of fiddling with forwarding only and acls.

Here is the db file:

;
; BIND data file for local loopback interface
;
$TTL    604800
@   IN  SOA ns1.domain.local. admin.domain.local. (
                  5     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;
@   IN  NS  ns1.domain.local.
@   IN  NS  ns2.domain.local.
ns1.domain.local.          IN      A       10.0.0.10
ns2.domain.local.          IN      A       10.0.0.11
web.domain.local.          IN      A       10.0.0.13

I’ve probably been staring at this too long and it’s something obvious but at this point I would really appreciate a second set of eyes.

Thanks in advance!!