So, I swear I've done this a few dozen times. Spun up a DC on an ESXi box, added DNS role...

My VMs can resolve using the DNS, but no computers outside the VM Network can resolve DNS.

They can ping the DNS server, I can remote into it from them, they just can't resolve DNS.