Keep AD. Names follow the lease.

Lattice does two DNS jobs and never mixes them in one process. The worker writes A/PTR after a lease. dhcpd does not talk DNS on Ack. lattice-dns is authoritative for Lattice-managed zones only. Recursion is off.

Most sites only need the adapter. Neither job makes Lattice the resolver the laptop uses for google.com or for the AD forest. Unbound, if you run it, stays the cache in front. Lattice updates zones; it does not recurse.

  laptop (stub)
       |
       |  every name
       v
  whatever option 6 said
  (AD, Unbound as resolver, BIND, or — rarely — lattice-dns)

DHCP option 6 is how a workstation learns its DNS server. NS records tell other nameservers where a zone lives. They do not repoint the laptop. Enabling DDNS does not fill option 6.

Unbound stays the resolver

Recursive lookup, forwarding, RPZ, public DNS, DNSSEC, and hosting the AD forest are non-goals. Unbound already does recursion. AD already does the forest. Day one does not mean “repoint every workstation.”

A laptop that has an IP and no name belongs in Work → DNS — the named queue for failed name writes. Replay is operator+. If the error starts with PTR, forward wrote and reverse did not. No reverse zone means PTR was never attempted.

One adapter per zone

Do not set embedded and BIND / AD / PowerDNS on the same zone. Split brain: two writers, two answers. Every tier includes BIND TSIG and AD GSS-TSIG.