It's been too long since I did DNS stuff apparently. At least half an hour of "why isn't this doing anything" before I remembered an nsupdate message needed "send" to actually, um, send.