I had a similar problem. I resolved it my doing a number of things.
1. Is your DNS server the only one on the network, or are you also using your ISP's DNS servers. If you are using your own DNS server, you will need to tell the DNS server to forward unknown requests to your ISP's DNS (DNS, select your server and right click for properties). I found that by deleting the root lookup zone (the dot at the start of your forward lookup zone), DNS was ok. The dot tells your DNS server that it is the authorative DNS server for your zone. If the Authoritive DNS server comes back with a "don't know" response it will not query another server so you will get DNS errors.
2. Also check which interfaces DNS is listening on. You'll find that it'll probably be listening on your internal and external network cards. If your dns server is located on the private, non routable network then select only that I.P. address for DNS to listen on. I would also deselect the round robin option within DNS properties.
3. Now have DHCP configure the clients so that the DNS server is your internal one (should show IP address as 127.0.0.0). These clients should be using the IP address of the internal network card as their gateway.
4. THe two server network cards should be configured as follows:
Internal Card - no gateway, internal DNS server.
External Server - gateway is your ISP router, and DNS should be your ISP's DNS server(s).
Within RRAS, you should check that each interface is correctly configured, as either internal or external.
Also check that your DNS reverse lookup zone is correct. An nslookup should show the following if your DNS is forwarding correctly.
H:\>nslookup microsoft.com
Server: localhost
Address: 127.0.0.1
Non-authoritative answer:
Name: microsoft.com
Addresses: 207.46.230.218, 207.46.230.219, 207.46.230.220, 207.46.197.100
207.46.197.102, 207.46.197.113
The local host is my DNS server saying I don't know what microsoft.com is, so I'd better check with the ISP's DNS - hence the non-authoritive reply. (I don't see much point in you and your ISP both being authoritive - let your ISP worry about most of the DNS stuff)
And lastly, check to make sure your static routes are OK. You should have one that points your external nic to the internet i.e. destination address (the internet) 0.0.0.0 and subnet will also be 0.0.0.0.
As an aside, I ran into problems with NAT being configured with a pool of useable I.P. addresses. Once I configured the pool to only contain one address, everything worked OK.
I hope there's something from the above which will point you in the right direction. Failing that, a recheck of all your network protocols wouldn't be a bad step. A couple of pings should indicate to you where the problem is. Using ping with the '-t' flag will allow ping to run for as long as you like. Ctrl -c will end it when your ready.