Some places I've worked, don't allow it. My current place does. I'd rather not (everything should go via the proxy), but sometimes you can't avoid it, and then you end up adding stubs or conditional forwarders to your AD-integrated DNS and it starts to get messy.