yes, this is possible.
Just be aware that if you have internal hosts trying to get a dns answer from the CSS they will also get the public ip.
There is no way to distinguished between internal and external host.
Normally, you should only answer with the private ip and the firewall uses dns fixup to translate the ip inside the dns response.
With a GSS, it is possible to use a src ip access-list so the dns response can be different depending on the ip of the requester.
Gilles.
