What is a DMZ in networking?

A DMZ (Demilitarized Zone) is a separate, isolated network segment between the internal trusted network and the untrusted Internet, typically used to host public-facing servers (web servers, mail servers, DNS servers, API servers). The DMZ sits between two firewalls (or using a 3-legged firewall): an outer firewall allowing Internet traffic to reach DMZ servers, and an inner firewall preventing DMZ servers from accessing the internal network directly. Benefits: if a DMZ server is compromised, the attacker cannot directly reach internal systems — they must breach the inner firewall. The DMZ can host: web servers, reverse proxies, email gateways, FTP servers, and VPN concentrators. Traffic flows: Internet → outer firewall → DMZ → inner firewall → internal network. This architecture implements defense-in-depth — an attacker must compromise multiple layers. Modern implementations often use micro-segmentation and zero trust instead of a traditional DMZ.