I don't know your perticular firewall software/how you can separate vlans/ip ranges etc etc.
If you put it behind the firewall-You'll be doing what's known as
Split DNS - ZimbraWiki then. (and
bind is immensily popular for that)
If you rely on an externally managed dns only and just give the box a public ip-if your dns resolution goes down-you ain't gonna be sending mail-even locally. (However you aren't going to be surfing the web or any other transactions either so you'll probably have bigger fish to fry.)
Maybe to get yourself started you do a dmz with a public ip address, then once you work out the setup, play with zimbra, understand your dns, etc - then move it to a split dns config.
Where do you go right now to manage your dns records-site5?