We're building a new set of web servers to be located in a DMZ, but we want them to be able to use our internal mail server. The mail server has a CNAME of
smtp.uk.ourdomain.com - our existing servers have an entry for this in their hosts file. However the actual mail server behind the smtp... CNAME may change periodically for maintenance, patching etc and currently if we want the web servers to keep up with this we have manually update the hosts file on each server.
Instead of a hosts file entry we want our new servers to be able to use DNS so they only ever send traffic to the smtp CNAME and let DNS do the name resolution, however we think there's a risk that if our web server gets pwned we're then exposing our internal network. What's the best way to set these servers up so they're secure but can resolve the names of the services we need from the internal network?