This is not the way to setup your DNS. You have created a .com zone and then two entries in that zone. It should be two separate zones. One for verisign.com and one for windowsupdate.com. No entries at all should be created in the zones.. This way a DNS request will be handled by your internal DNS server for those zones but immediately the client will get a host name unknown.. With your current setup you still have a time out..
Please see attached screen shot..
