You should place your mail forwarders/scrubbers (ideally one for inbound and one for outbound - increased load balancing, fault tolerance, security) on the DMZ and have your mail server on the inside. The mail forwarders can scan for virus' etc before they enter your environment or leave your environment. No one on the internet should have direct access to your internal network. That is what the DMZ is for. The internet should have access to the mail forwarders over certain ports (eg 25) at that's it. The forwarders then would have access to your internal mail server only over port 25 or whatever you want. This way, if your forwarders are compromised, they still don't have access to your internal network. It adds another layer of security. And of course use NAT between all the interfaces.
Hope it helps.
Steve
