DNS in DMZ or not and mail server architecture

Question

I wonder what server I put in DMZ zone. I know the DMZ zone is for all servers or services who must be accessed from the internet, like Web Server, or mail server and sometimes DNS servers.

But I wonder two questions, for the mail server: the best secure practice is to have two servers, like front-end (webmail server who send a commands to back-end server) and back-end server who have all email in his disk? Because, if I have just one mail server and it is in DMZ zones with a sensible data (mail, address book, user information) is not a good idea, is it?

And my second question, why must my DNS server be accessed from internet? If I want to redirect a domain name to my server I buy a domain name from a hosting service and I redirect it on my router and in my router configuration I redirect the traffic to the server in my DMZ zone, in my ideas.

Answer 1

Bind has provisions for internal and external facing DNS. Just in case you want to have internal only domain names. In this way you can serve both facing queries. It also has settings that allow only trusted users from accessing it.

Answer 2

Please forgive me if I misunderstood but here is my answer from what I gather you are asking:

If you want to set up a server behind your internet connection I would refrain from using DMZ and use port forwarding. Putting a server on DMZ without a vast amount of experience is a dangerous thing to do.

List out your specific services and set up forwarding rules for example port 53 to redirect to webserver of your choice. I would never put something in DMZ if I can avoid it.

To answer your second question, you can set your server up as a DNS server but the problem here is people would then need to use you as a DNS server.If you are offline set up your own DNS server and redirect your internal traffic all you want. The DNS servers exist on the internet so other people can be directed to the same location around the world.

Answer 3

For the mail, the best practices recommend that the mail server(s) that is (are) used by internal user should not be in the DMZ, nor even directly accessible from the outside. But as you want to be able to allow incoming mails from internet, you generally put a auxilliary server in the DMZ that receives incoming mails and forward them to the main internal server. That way if the relay is victim of dos attacks, the internal server(s) should not be affected.

For the DNS, it can make sense to have a dedicated DNS server in the DMZ if you have several servers there. Instead of configuring a DNS on each and every server, you configure just one, targeted to the DMZ environment and all other DMZ servers use it. That allows to reduce the allowed communication between the DMZ and the internal network.