acl "dmz" {
        xxx.xxx.xxx.xxx/27;
        yyy.yyy.yyy.yyy/26;
};


view "external" {
        match-clients { any; };
        allow-recursion { dmz; };

	zone blah blah blah
};

(so that the dmz can do recursion off the external view, but
no one else can)