The ipcop firewall has a caching dns proxy built in, and you need to understand how this affects your DNS configuration.
Your clients in green need to use your
DNS server in green only
Your
DNS server in green needs to use ipcop as it’s upstream server, NOT your ISP’s
DNS servers
Your
DNS server in orange (which seems wrong unless you have a lot of servers) needs to use only your ISP’s
DNS, NOT the ipcop or the
DNS server in green.
If your clients in green need to resolve IP addresses for servers in Orange, add these IP addresses and names into your DNS in green.