hi, you do not need to install the pri dns in the dmz. you can install your pri dns in your lan and communicate through the dmz with the sec dns at your isp. you only need the ip of your sec dns at the isp and set the rules(chains or tables: ipchains or iptables) at your firewalls that only the pri dns (ip-address) can communicate with the sec dns (also ip-address required) at your isp and the other way around. MfG. Stefan Walther stefan_walther@gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961