Hi Matthew, when Samba is restarted the resolve.conf is parsed and nameservers are passed as --option=dns forwarder option of samba process in the DC container.
To manually restart samba-dc run for example:
runagent -m samba1 systemctl --user restart samba-dc
I’d suggest to not mix internal and external nameservers: responses can be inconsistent. See also Samba Internal DNS Back End - SambaWiki
In your case, set only the internal NethSecurity IP as nameserver.