I think you might be making a loop here. Do you have all DNS requests coming into the firewall forwarded to the SME instead? If so, I'd think that when an external domain is requested to the SME DNS, it tries to get out to an internet DNS server, and hits the firewall and is sent back to itself. I'm not sure if that's right, but it sounds like it could be logical.
Try configuring a client to use the SME's IP for DNS, and turning off DNS forwarding to the SME on the firewall...