acl "dmz" {
        199.227.4.32/27;
        12.109.62.64/26;
};


view "external" {
        match-clients { any; };
        allow-recursion { dmz; };

	zone blah blah blah
};

(so that the dmz can do recursion off the external view, but
no one else can)