I found this question very illuminating about DMZs and when to place a server in one.
We're re-organizing our internal company network (keeping the same external IPs and domains), our mainly Windows servers (we use WinAD heavily) will be kept on the LAN with firewalls and port forwarding to direct external traffic.
What are the security (dis)advantages setting a server (example: email) up on a different VLAN to the rest of the internal network rather than inside a DMZ?
That's a bit of an apples and oranges comparison. A DMZ is a separate network segment for systems with a greater risk of compromise; a vlan is a mechanism for achieving logical separation between different logical networks on the same physical network.
The comparison you probably want to make instead is this one: Should I implement my DMZ through physical separation by using separate network infrastructure, or through logical separation on the same network infrastructure?
With physical separation, the main barrier is cost; you'll be investing in dedicated network equipment for what sounds like a small number of DMZ systems. There's also extra management time involved in setting up and maintaining that infrastructure.
With vlan separation, you'll be essentially building the same logical infrastructure as with the physical separation; a dedicated vlan with its own subnet, the device doing the routing between the subnets will apply access controls, etc.
However, the concern is security; sharing the same physical infrastructure increases the number of potential attack surfaces for an attacker who has compromised a DMZ device to try to access the non-DMZ network.
When using just the logical separation, vlan hopping attacks, as well as direct remote exploits against the network devices accessible to the DMZ (but serving both networks) are potential risks, as well as a greater risk of a misconfiguration in a single device compromising the barrier between the networks.
