[CentOS] BIND with ACLs

Dear Friends,

I created um DNS server for network Internal and External same SERVER, 
but the control by ACLs in named.conf don't work, when I active ACLs the 
server don't resoluction external domain names.

Please, check NAMED.CONF file.

//
// named.conf for Red Hat caching-nameserver
//

options {
         directory "/var/named/";
         dump-file "/var/named/data/cache_dump.db";
         statistics-file "/var/named/data/named_stats.txt";
         /*
          * If there is a firewall between you and nameservers you want
          * to talk to, you might need to uncomment the query-source
          * directive below.  Previous versions of BIND always asked
          * questions using port 53, but BIND 8.1 uses an unprivileged
          * port by default.
          */
          // query-source address * port 53;


         allow-query {
                 127.0.0.1/32;
                 192.168.1.0/24;
                 200.245.88.23/32;
                 200.162.222.37/32;};

         allow-transfer { 127.0.0.1/32;
                     192.168.1.0/24;
                     200.162.222.37/32;
                     195.20.105.149/32;
                     193.111.27.194/32;
                     194.145.96.21/32;
                     193.23.158.13;};

         allow-recursion { 127.0.0.1/32;
                     192.168.1.0/24;
                     200.162.222.37/32;};

//        allow-notify { 127.0.0.1/32;
//                    200.245.88.23/32;};

};
// LOG
logging {
    channel query-log {
       file "/var/named/data/query-log" versions 5 size 50m;
    };
    category queries { query-log; };
};

acl internals {
                 192.168.1/24;
                 127/8;
};

//
// a caching only nameserver config
//
controls {
         inet 127.0.0.1 port 953 allow { localhost; } keys { rndckey; };
};

view "external" {
     match-clients { any; };
     recursion no;

zone "conntrust.com" IN {
         type master;
         file "conntrust.com.hosts";
         allow-update {none;};
         allow-query {any;};
         allow-transfer {any;};
};


zone "whitelist.conntrust.com" IN {
         type master;
         file "whitelist.conntrust.com.hosts";
         allow-update {none;};
         allow-query {any;};
         allow-transfer {any;};
};

}; //acl external

view "internal" {
     match-clients { internals; };
     recursion yes;



zone "." IN {
         type hint;
         file "named.ca";
};

zone "localdomain" IN {
         type master;
         file "localdomain.zone";
//      allow-update { none; };
};

zone "localhost" IN {
         type master;
         file "localhost.zone";
//      allow-update { none; };
};

zone "0.0.127.in-addr.arpa" IN {
         type master;
         file "named.local";
//      allow-update { none; };
};

zone 
"0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" 
IN {
         type master;
         file "named.ip6.local";
//      allow-update { none; };
};

zone "255.in-addr.arpa" IN {
         type master;
         file "named.broadcast";
//      allow-update { none; };
};

zone "0.in-addr.arpa" IN {
         type master;
         file "named.zero";
//      allow-update { none; };
};


     zone "conntrust.com" IN {
         type master;
         file "internal.conntrust.com.hosts";
       allow-update { internals; };

     };


}; // acl internal

include "/etc/rndc.key";


Thanks


Adriano