DNS, like any network service, is a potential security risk if it's not configured correctly. The most common DNS security threat is a DNS server that gives out too much information. Every bit of information about your network can be useful for an attacker, so keeping this information to a minimum is vital. Often, the first step an attacker will take is to try to build a map of your network, and your DNS servers can provide that map. For example, an attacker might attempt to perform a zone transfer on a server, which will return all host names and IP addresses in that zone.
Although DNS servers block zone transfers by default, that might not stop attackers from gathering information from your DNS servers. Another technique they might use is to query thousands of common host names, essentially brute-force guessing your network structure. The only real defense is to keep the information on public DNS servers to a minimum.
Yet another attack is a Denial of Service (DoS) attack on your organization's DNS servers. By flooding a DNS server, an attacker might use up the server's available resources and cause it to stop responding to requests. Having several servers on separate networks and keeping your server roles isolated can help minimize these attacks. An attack against your external servers will then have no affect on your ability to resolve host names internally.
Another threat is DNS cache poisoning, in which an attacker tricks a DNS server into caching incorrect DNS information. This threat lets an attacker redirect users to one host when they think they're visiting another—a scenario that's useful for a variety of attacks. Windows' DNS service has features to specifically block these attacks, but the service isn't perfect, and future research might turn up more elaborate techniques. The best way to prevent such attacks is to prevent attackers from accessing your caching DNS servers.
Another threat is that an attacker might actually break in to your DNS server
and gain access to and even modify DNS information. If you isolate your DNS
servers, you lessen the likelihood that any single server or server role will
be compromised.