Windows Server 2025 DC with two network adapters registers the NAT IP in DNS

This is the classic multihomed domain controller problem: a DC registers every IP it has in DNS, so the NAT address ends up in the zone and your client may get it back and fail to reach the domain. The cleanest lab fix is to avoid two adapters on the DC at all, for example keep only the internal adapter on the DC and give the DC internet through a router or the host, but if you want to keep both, do this:

• Stop the NAT adapter from registering. In the NAT adapter's IPv4 properties go to Advanced > DNS and untick Register this connection's addresses in DNS. Leave the DNS server on that adapter empty, and set the internal adapter's DNS to the DC's own internal IP (192.168.10.x).
• Make the DNS server listen only on the internal IP. In DNS Manager open the server's properties > Interfaces and select Only the following IP addresses, with just the internal one. That also stops the NAT address from appearing as a name server.
• Set the binding order so the internal adapter is first (Network Connections > Advanced > Advanced Settings).
• Clean up what is already registered. In the zone and in _msdcs, delete the A records and NS entries that point to the NAT address, then restart Netlogon and run ipconfig /registerdns and nltest /dsregdns on the DC.
• On the client, run ipconfig /flushdns and ipconfig /registerdns, and confirm nslookup yourdomain.local returns only the internal address.
• For internet name resolution, add a forwarder (for example 1.1.1.1 or the host's resolver) on the DNS server instead of putting the NAT DNS on the DC's adapter.

Check afterwards with dcdiag /test:dns and by reading the zone, and the NAT address should no longer come back after a reboot.