My Setup is as follows:
Internet --- IPCop --- Green
Incoming Mail goes to a contribs.org SME Server in DMZ where it is
scanned for viri / spam and then passed to my SBS Server in Green. The
only pinhole that has to be opened is port 25 SMTP Mail is sent from
SBS via the SME Server as well.
I know this isn't the same as what you want to do but it seems simpler
than having the Domain Controlled in the DMZ. I allow remote access by
VPN (SBS2003) for Outlook / OWA It all works fine.