Bind “can’t find example: SERVFAIL”

I'm trying to setup a dns server on my LAN because my router doesn't support nat reflection and I have virtualhosts which require a domain (can't be reached by IP address) running on apache. I'm not very familiar with zone files but I think I'm on the right track. My domain is tenex.us and I want to reach it on my lan by using tenex.local (with an appropriate vhost added to apache). The dns server is working as it resolves and caches other addresses, including tenex.us but I get

server can't find tenex.local: SERVFAIL

I have named.conf as follows

include "/etc/bind/named.conf.options";

include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

zone "tenex.local" IN {
  // this is the authoritative server for
  // tenex.us info
  type master;
  file "db.tenex";
};

and db.tenex as follows

$TTL 86400

@       IN      SOA     ns1.tenex.local.      craig.tenex.local. (
                        2014120705
                        28800          
                        7200           
                        864000          
                        86400          
                        )

                IN   NS      ns1    
                IN   NS      ns2    
@               IN   A  10.1.1.2
ns1             IN   A  10.1.1.2
ns2             IN   A  10.1.1.2
www             IN   CNAME @    
dev             IN   CNAME @
ftp             IN   CNAME @

and named.conf.options as follows (other files are default install files as of 12/6/14)

acl clients {
        10.1.1.0/24;
        10.1.2.0/24;
        localhost;
        localnets;
};

options {
        directory "/var/cache/bind";

        recursion yes;
        allow-query { clients; };

        forwarders {
                8.8.8.8;
                8.8.4.4;
        };
        forward only;

        dnssec-validation yes;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

I'm not an expert on DNS but here is how I think this works. Correct me if I'm wrong, it will help me alot.

1. I query the server for tenex.local,
2. It sees that there is a zone listed for tenex.local and then returns the contents of the zone file for that entry to the device that queried it.
3. The device sees that the authoritive name server is ns1.tenex.local and that current address matches the address of ns1.tenex.local's A record in the zone file (10.1.1.2) so it is (supposed to) resolve to the A record for www.tenex.local/tenex.local/dev.tenex.local/etc.