Make sure dns inspection is not disabled. This should look something like the following.
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
If this is disabled, the dns keyword does not work. Additionally, you need to make sure you flush the cache on any internal dns server and client. This will force the actual dns request to go through the ASA.
