External DNS Name resolution concerns

hi folks,

we have long standing dns issues @ office cure, possibly using isa server out. here our situation.

our internal network contains single homed isa 2k4 server has firewall chaining upstream box provided externally. our internal network sits before mpls connection offsite location. our offsite location contains our 3 homed hardware firewall , our dmz in 3 leg perimeter config.

our internal dns servers contain root zone no clients including isa server can resolve internet names. have no dns server in company can resolve external host names. every web request handled via proxy , resolution names provided our external providers upstream firewall.

my problem nothing can resolve internet names. @ all. because our smtp smart hosts email provider well, have put in ip addresses exchange server config, rather dns name of cluster. examples ongoing, use bloomberg requires dns resolution work correctly on client workstation , @ present stuck on adsl line instead. not hugely professional workaround.

heres want

1. servers need resolve internet names should able
2. workstations need should able

heres boss wants

1. no internal name resolution due security.

so, feelings need dns server can resolve externally, not forward external requests our internal network (dns in dmz?) allow workstations i.e our bloomberg box, i'm thinking our isa server needs able external name resolution (make isa servers dns new dns server can external) isa box can proxy workstations machines using firewall client external requests.

that leaves me few questions though

1. isa server in single card config task?
2. must dns server in dmz or can within internal network long it's not aware of other dns's , none of other dns servers use recursion?
3. idea have servers resolving host names externally or have ability if don't neccessarily need it?

i hope i've made myself clear, feels i'm missing important part of puzzle. conceptually think don't understand how provide external resolution machines require not others. seems bit of 'all or nothing' situation.

 

------------- bit more thought came below (post made on forum)

 

if place dns caching server in our network conditional forwarding queries internal domain pushed our ad dns server , external requests pushed our isps dns, configure our isa servers single network card have caching server it's dns, should left in situation isa server can resolve both internal , external host names internal clients not able resolve externally (which good).... @ point can use fwclient machine requiring external name resolution function (for example bloomberg terminal)

if reasoning sound, have still issue

must caching server inside dmz or 'safe' have within our internal network port 53 open through firewall? also, if have conditional forwarding on, internal requests bumped internal ad server, safe outside world learning whereabouts of ad dns servers etc?

i hope more expertise me can give me pointers.

i'd set this:

 

a single internal dns forwarders externally (your isp's dns-servers example) (not dc)

do not include dns in dhcp-scope add manually computers need name resolution.

open isa allow dns-traffic dns-server only, means computers need talk one.

keep in mind it's single point of failure though...

 

since need have external name resolution, can have internally , doesn't have reachable outside.

(i might have misunderstood question...)

Windows Server  >  Network Infrastructure Servers