If you are confident to put your dns outside the firewall then you need to configure your dns server tightly. If it is a local dns server for your company network, then put it behind a firewall and setup all the workstation to point to this dns server's local ip.
Just my 0.02 cents.
Just my 0.02 cents.