Due to our architecture, monitoring an instance over a WAN could be problematic. My recommendation would be to install DPA in the same location (network) as the monitored instance and access the web UI over the WAN. The reason for this is we want to make sure we're getting the performance data collections successfully and if there's any latency involved, it would just be in rendering the UI. As far as the untrusted domain goes, can you monitor using SQL authentication? If not, then you may have issues unless you set up an AD authenticated account in the domain being monitored as well. Hope that helps!