Seems that in my 'traditional' forward zones config file I was missing the '+' +forwarded.zone=9.9.9.9,8.8.4.4 then yes, public recursors work - otherwise NS for those domains are needed (as a side-note to beginner like myself) thanks, L.