DNS/AD access from DMZ

Hello all,

I just inherited a nightmare….I mean network that I have some questions about.

The first is in regards to an exchange server in the dmz. Our network is using private addressing for internal and all DMZ resources have public IP addresses. The exchange server primary dns points to an internal private IP/DNS server and it’s secondary points to a DMZ DNS server with a public IP address.

My question is regarding best practice and possible security issues with this configuration. I have quite a few more questions to come.

Thanks!