DNS for internal servers

Question

Okay, this should be simple, and maybe I'm just missing something.
I've recently had to move from a 10.3.9 server to a 10.4.10 server. We have 2 servers in-house, the main one that runs DHCP/DNS/Mail, and a second one which does file service.
Reference info:
File Server - 192.168.2.105
Mail Server - 192.168.2.99
The mail server his handing out DHCP, with the following DNS entries:
1st - 192.168.2.99
2nd - 151.164.8.201
3rd - 151.164.1.8
The mail server had DNS turned up and has 1 primary zone: mail.kccompany.org at 192.168.2.99
Under that it has 3 machines setup under that zone:
fs - 192.168.2.105
mail - 192.168.2.99
www - 64.207.xxx.xxx
Now, here's my problem: When my users try to lookup mail.kccompany.org, they get the external 216.xxx.xxx.xxx address, and not the internal 192.168.2.99 address. I have some mobile users who would like to use and access email from home. I have SMTP authentication working, but when they're inside the network, mail.kccompany.org doesn't translate to the internal address like it should. Am I missing something?
DHCP leases are set for 8 hours. I have been working on this for a week, so they should have updated info. And doing a lookupd -flushdns doesn't seem to effect the issue.
Any help would be greatly appreciated! Thanks.
PowerBook G4 17   Mac OS X (10.4.10)   1.5G RAM

Answer 1

As requested:
// Include keys file
include "/etc/rndc.key";
// Declares control channels to be used by the rndc utility.
// It is recommended that 127.0.0.1 be the only address used.
// This also allows non-privileged users on the local host to manage
// your name server.
// Default controls
controls {
inet 127.0.0.1 port 54 allow {any;} keys {
"rndc-key";
options {
directory "/var/named";
recursion false;
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
// query-source address * port 53;
// # Adding this...
forwarders {
151.164.8.201;
151.164.1.8;
forward first;
// # to here..
// a caching only nameserver config
zone "." IN {
type hint;
file "named.ca";
zone "localhost" IN {
type master;
file "localhost.zone";
allow-update { none; };
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.local";
zone "" IN {
file ".bak";
masters {
type slave;
zone "kccompany.org" in {
file "kccompany.org.zone";
type master;
zone "200.168.192.in-addr.arpa" IN {
file "db.192.168.200";
type master;
zone "xxx.207.64.in-addr.arpa" IN {
file "db.64.207.xxx";
type master;
logging {
category default {
defaultlog;
channel defaultlog {
file "/Library/Logs/named.log";
severity info;
print-time yes;
};