Put AD-joined hosts in a subdomain, e.g. <i>subdomain.example.com</i>. AD DCs are authoritative for the subdomain. Your public facing &#x2F; authoritative nameservers for <i>example.com</i> should be listed (publicly) as the only NS&#x27;s for <i>subdomain.example.com</i> and should slave it from your DCs.