# What is a Demilitarized Zone (DMZ)?

> A demilitarized zone (DMZ) is a controlled network segment placed between networks with different trust levels, commonly the public internet and an internal enterprise network.

- Canonical URL: https://yellowcube.eu/glossary/demilitarized-zone/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It hosts services that require external reachability without providing a direct path into more trusted systems. Traffic entering or leaving the DMZ crosses explicitly managed security boundaries and is limited to required flows.

Public web front ends, reverse proxies, authoritative DNS, mail relays, and remote-access gateways are common DMZ residents. A DMZ can use separate firewalls or multiple policy zones on one platform; the label does not prescribe a topology. Administration, updates, and backend connections require controlled paths.

### Key points

- **Service placement:** Keep internet-facing components separate from sensitive databases, identity systems, user networks, and management planes. Store only necessary data and credentials.
- **Flow control:** Default-deny traffic in both directions, then permit specific sources, destinations, protocols, and purposes. Compromised hosts may call home or pivot inward.
- **Operations and availability:** Use hardened management, centralized logs, resilient dependencies, capacity protection, patch plans, and tested recovery. DMZ failures can interrupt services.
- **Important limitation:** A DMZ contains risk; it does not make exposed services trustworthy or create an air gap. Permitted flows can carry attacks, shared administration can bridge zones, and a bypassable DMZ offers little isolation. In operational technology, an IDMZ is a distinct IT/OT boundary with safety and availability constraints, not an internet DMZ renamed.

### Related terms

[Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Firewall](<https://yellowcube.eu/glossary/firewall/>) · [Industrial demilitarized zone (IDMZ)](<https://yellowcube.eu/glossary/industrial-demilitarized-zone/>) · [Reverse proxy](<https://yellowcube.eu/glossary/reverse-proxy/>) · [Network access control list (ACL)](<https://yellowcube.eu/glossary/network-access-control-list/>)

### Sources

[NIST CSRC glossary: Demilitarized Zone](https://csrc.nist.gov/glossary/term/demilitarized_zone) · [NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy](https://csrc.nist.gov/pubs/sp/800/41/r1/final) · [NIST SP 800-82 Rev. 3: Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.