Demand dial filters – examples

Does anyone out there have any examples of demand dial filters for windows 2000 that will only dial to access the internet and ftp ect.
The problem i’m having is that i have installed rras on a windows 2000 domain controller and the demand dial connection to the internet keeps connecting on interneal dns quriers to the dc, but i cannot set a demand dial filter to stop dns quries because the dns server would not then be able to connect to root servers on the internet to access dns information; any ideas or examples that others have used would be helpful, the phone bills getting quite big now!