Should DNS servers go in the lowest security DMZ?

[webnetwiz]

I had a config where the DNS server was sitting at a higher security level DMZ than an email server. There was no static or conduit built between the 2 DMZ interfaces, but the email server should've used the global static for the DNS server. However it wasn't resolving names, and I had to take it offline. Any thoughts?

Thanx

 

[majestrate]

what if you created 2 conduits between the two, but limit the ports. create one conduit for tcp 53 and one for udp 53. instead of typing the port you can also use the literal name "domain" (obviously without the quotation marks). good luck...