Our network is protected by a firewall but my predecessor put both the primary and secondary DNS servers that resolve our domains to the outside world outside of the firewall protecting our network.