Knowing that is a Domain Controller, it would then be only used by people within the internal network right?
Might wanna double check with this related question.
Whether or not your host it in the DMZ, I highly recommend aiming for a setup where only traffic involving UDP port 53 is allowed and that's both inbound and outbound.
You could achieve that through configuring NGFW, some device that has a stateful firewall, or a host-based firewall within the DNS server. If you could have like 2-3 of these done then that's good since defense in-depth is very good practice. Test that it's working properly for each defense configured to ensure availability of your device.
If you're placing it in the DMZ however, it is of absolutely importance to have a firewall device between your DNS Server and the router to ensure it is segmented and kept away from your internal network should it get compromised by hacker/s.
Always remember that no defense is absolute so prepare plans/protocols to follow should a hacking attack succeeds and escalates to prevent/re-mediate the emergency.