@Twisty well, I can't answer. As it would be a server open to your DC (RPC, DNS, LDAP, File access to NETLOGON, etc..) to be domain joined, a server that got access to another server in fileshare, ... Why you dont put it simply in the LAN and setup VPN access ? and I talked about reverse proxy, is it a webapp ? as usually you can easily setup that, so the server stay in the LAN, and the one in the DMZ just replicate what server in the LAN see in big.
@Twisty but for original's question, if a leak happen, you must assume he can get all your information where he got access to, simple as that. You can ask on meta* too to get other opinion, it would be the best way I think
