If you want your clients to query the internet directly, you need to add a rule allowing either them, or the network they are on to access udp/53 :
DNS Any Allow
or the like will work.
If you want to use the DNS proxy, enable it, and tell it which network interfaces to listen on, and if necessary what external internet DNS servers to use as forwarders (your ISP's maybe). If you don't set forwarders, Astaro will use the DNS root servers... if this is greek to you, basically "it will work".
The DNS definition is a combined tcp/udp rule, and so if you choose option 1 above, any internal DNS servers can do zone transfers if needed.
