Внутренним он был бы, если бы начинался с 192.168. А этот точно внешний...

http://www.experts-exchange.com/Security/Firewalls/Q_20736108.html

Accepted Answer from EmpKent
Date: 09/11/2003 12:10PM PDT
Grade: A
Accepted Answer

Copying and pasting from www.minasi.com...

what IS this
prisoner.iana.org? Well, once RFC 1918 (and its predecessors, actually)
came out, the IANA -- the old name, recall, for the folks in charge of
handing out IP address blocks -- realized that they needed a "placeholder"
in-addr.arpa zone for the three ranges of non-routable addresses. So they
put zones named 10.in-addr.arpa, 16.172.in-addr.arpa, and
168.192.in-addr.arpa on a three DNS servers named blackhole-1.iana.org,
blackhole-2.iana.org and prisoner.iana.org, at IP addresses 192.175.48.6,
192.175.48.42, and 192.175.48.1, and prisoner is set as the primary DNS
server for the zones.


Thus, if one of your systems with a 192.168.x.x address tries to register
its PTR record then it will, unless you have a local DNS server with a
168.192.in-addr.arpa zone, end up trying to register with prisoner.iana.org
-- which will reject the request. The bottom line is, don't worry about it
in most cases. In one case, however, you MIGHT worry about it, if you were
running an intranet with a dialup connection to the Internet. If your
intranet systems have private addresses and you don't have a local reverse
lookup zone for your private addresses then you will cause your systems to
try to contact prisoner, which would trigger a dialup. And if you're
connected via ISDN in some country not blessed with as low a set of telecomm
rates as we enjoy in the US, then that could be a quite expensive
proposition. Again, the answer in that case would either be to tell your
system not to do dynamic updates at all, or to create a local DNS server
with a dynamic 168.192.in-addr.arpa zone.


Kent

Т.е. это внешний ДНС-сервер.