I've seen a few DMZ related questions here in the past, but wanted to ask one directly related to email. I've done some research on this, but wanted to ask the forums opinion.
I know it's best practice not to have anything externally hit your LAN directly, but I've seen implementations where external hosted email is being sent directly into the LAN towards the internal mail servers. My gut was telling me this was wrong, but how does putting an external load balancer, or reverse proxy server add additional security? Is it because it's cutting the connection and starting it again from within these system in the DMZ? I was having problems understanding why this would be more secure, even though I'm more comfortable with it happening. Should there be filtering of the requests occurring here?
Also, I know that the DMZ and LAN should never speak (in theory), but how are internal resources supposed to access external mail? I've read that it's more secure if there's a separate DMZ for mail and that the LAN users should only have access into the the DMZ, not the DMZ into the LAN.