Although interestingly, doing an nslookup on a completely fake domain looks a little different:
nslookup monkey.monkey
;; Got SERVFAIL reply from 127.0.0.1, trying next server
Server: 4.2.2.2
Address: 4.2.2.2#53
** server can't find monkey.monkey: NXDOMAIN
There's one less line that looks like ";; Got SERVFAIL reply from 127.0.0.1, trying next server". The hartman lookup had two of those.
I wonder if the first line is Zentyal (127.0.0.1) saying "yes, I've heard of the "hartman" domain. Try asking 127.0.0.1" and then the second line is (a different piece of?) Zentyal saying "I don't know what you're talking about". Is that possible? Are the different db files in /etc/bind representative of different hops along the resolution path? Or different sub-processes of bind?
Anyway, it's almost 7am here and I've been up all night so I'm heading to bed. Keep the suggestions coming by all means though. This is driving me crazy.