What is a DMZ in IT, where does the term come from, and which systems belong in it?

A DMZ (demilitarised zone) is a network segment placed between two security zones, typically between the internal network and the internet. It holds the servers and services that must be reachable from the internet, such as web server, email exchanger, DNS and web application, and access to it is strictly regulated.

* Three zones instead of two: the internet-facing servers move out of the LAN into their own segment between two firewalls. *

The term is borrowed from geopolitics: a demilitarised zone is an area, typically a border strip between two rival states, where no military may be stationed or moved. In IT the meaning is adapted: the DMZ is a buffer that belongs neither to the trusted inside nor to the hostile outside.

Compared with the flat LAN, the internet-facing servers are moved out into their own segment. The internal systems (inventory, CRM, accounting servers, the database) stay in the internal LAN, and a firewall on each side of the DMZ controls what may cross.

Go deeper:

• DMZ (computing) — Wikipedia — single-firewall versus dual-firewall DMZ designs and which services go in it.
• Demilitarized zone — Wikipedia — the military origin of the term.