I wonder what server I put in DMZ zone. I know the DMZ zone is for all servers or services who must be accessed from the internet, like Web Server, or mail server and sometimes DNS servers.

But I wonder two questions, for the mail server: the best secure practice is to have two servers, like front-end (webmail server who send a commands to back-end server) and back-end server who have all email in his disk? Because, if I have just one mail server and it is in DMZ zones with a sensible data (mail, address book, user information) is not a good idea, is it?

And my second question, why must my DNS server be accessed from internet? If I want to redirect a domain name to my server I buy a domain name from a hosting service and I redirect it on my router and in my router configuration I redirect the traffic to the server in my DMZ zone, in my ideas.

  • Yes, if you have no specific requirements regarding DNS, it is ok to buy a "domain name" (in fact: buy a name and a service of a basic DNS) from a provider.
    – kubanczyk
    Commented Sep 13, 2016 at 12:23

3 Answers 3


Bind has provisions for internal and external facing DNS. Just in case you want to have internal only domain names. In this way you can serve both facing queries. It also has settings that allow only trusted users from accessing it.


Please forgive me if I misunderstood but here is my answer from what I gather you are asking:

If you want to set up a server behind your internet connection I would refrain from using DMZ and use port forwarding. Putting a server on DMZ without a vast amount of experience is a dangerous thing to do.

List out your specific services and set up forwarding rules for example port 53 to redirect to webserver of your choice. I would never put something in DMZ if I can avoid it.

To answer your second question, you can set your server up as a DNS server but the problem here is people would then need to use you as a DNS server.If you are offline set up your own DNS server and redirect your internal traffic all you want. The DNS servers exist on the internet so other people can be directed to the same location around the world.

  • Yes you understand my questions, thank you for you answer. In my mind the DMZ zone is like a LAN zone, that all is forbidden and i authorize just a port that i need, with port forwarding. For me the security of having a DMZ zone is the attacker is limited on this zone because if i don't have a DMZ zone, just LAN with port forwarding rules like you said me, if an attacker can see where a port 53 are forwarding, he know my LAN server and can want enter on my LAN network, you see what i want to say ? My english is not not my best quality ^^
    – Ilies
    Commented Jan 17, 2016 at 13:39
  • I know that but my really question is WHY people need to use my DNS server if im not a internet acces provider. If people need to access on my mail server in example with a DNS domain like "mailserver.contoso.com" i buy a domain name contoso.com at a hosting service and i redirect this on my router who forward all traffic on port 53 on my front-end mail server in my DMZ Thanks for your help
    – Ilies
    Commented Jan 17, 2016 at 13:40
  • See how i see the IT architecture that i speak Picture
    – Ilies
    Commented Jan 17, 2016 at 15:00

For the mail, the best practices recommend that the mail server(s) that is (are) used by internal user should not be in the DMZ, nor even directly accessible from the outside. But as you want to be able to allow incoming mails from internet, you generally put a auxilliary server in the DMZ that receives incoming mails and forward them to the main internal server. That way if the relay is victim of dos attacks, the internal server(s) should not be affected.

For the DNS, it can make sense to have a dedicated DNS server in the DMZ if you have several servers there. Instead of configuring a DNS on each and every server, you configure just one, targeted to the DMZ environment and all other DMZ servers use it. That allows to reduce the allowed communication between the DMZ and the internal network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .