Thanks for posting in Q&A platform.
For question if AD DC with DNS role needs to access to Internet, please kindly note that if you need the DNS server only to resolve and manage the internal domain name, then you do not need grant Internet access to it. If you need the DNS server to forward the domain name resolution to the public DNS server or handle DNS requests with root hint, then please grant Internet access to it.
For more details please refer to the following article.
Best practices for DNS client settings in Windows Server
Please kindly note I'm a support engineer from Windows-DHCP-DNS team, and I'm not familiar with Exchange server. For questions related to Exchanger server, I would suggest to open a new thread only with office-exchange-server-administrator and office-exchange-server-mailflow tags so that so that you would get more professional support from Exchange server support engineers.
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.