I have OWA published and it works as advertised using the outside ip/exchange/ but using dns webmail.crossoil.com/exchange/ returns the user an error from ISA. Could this have anything to do with my internal DNS servers?