Why does Active Sync favor 3G DNS lookups over the local network?

We want to utilize I-Phones to replace our dated Blackberries. To do this we setup an Active Sync server that has a public IP address associated with it that NAT's to an internal address. We then setup our external DNS servers to point the AS server name to the public address, and our internal DNS servers to point the AS server name to the internal address. The idea here was that regardless of your location (on or off the network) you would always get your e-mail via push as DNS would resolve the right address depending on your location (Internal and extenal DNS names are the same). This works - however what I'm seeing is that even when a user is on the local network they are still resolving to the external DNS address. If I turn "Cellular Data" off, DNS resolution works as intended. I thought it might be a caching issue, but I see the phones immediately go back to the 3G DNS lookups when "Cellular Data" is reactived Is there any way to tell the I-Phone to prefer local DNS over carrier DNS? Is there an app that could do this?

Thanks!