delegating name servers in Bind9

[dninja at gmail.com (Robin Wood)]

Hi
I'm trying to play with DNS tunnelling and need to setup a name server
for a subdomain on my network. I'm running Bind9 locally and from what
I've read the setup should be simple but I can't get it to work.

I've got these lines in my db.attack file:

attack.int.  IN NS digininja.org.
tunnel.attack.int.   IN  NS  desktop.attack.int.
desktop  IN A 192.168.0.4

which I think means that anything to attack.int is taken care of by
the nameserver digininja.org but anything to the subdomain
tunnel.attack.int should be passed to the nameserver running on
desktop.attack.int.

I can get an IP for desktop.attack.int but not for tunnel.attack.int
or *.tunnel.attack.int . I've watched traffic and there are no
requests coming into desktop so the delegation isn't working.

Can anyone suggest what I'm doing wrong?

Robin