DNS CAA proper internal configuration

What is a valid configuration of internal CAA records (internal - not visible in Internet) on Windows DNS servers:

• You should point to valid source of certificates - "issue" prefix for DNS record, for example if Your internal PKI is from pki.internal.contoso.com you should place record issueinternal.contoso.com or issuecontoso.com; this will cover also wildcard certificates;
• If You don't want to allow wildcards You should place another DNS record with empty source record like "issuewild;" - allowed entries is empty; 
• binary representation  of DNS record contains first byte equal zero (the higest bit has critical meaning, rest is not used now), next byte value 5, rest of record is a string data, e.g. "<00><05>issuewild;"
• binary representation must be located in DNS record of Type257

dns record timestamp in Active Directory partition

how to force AD to replicate timestamps? I can't use Scavanging - too many different objects - huge risk of loss of data, I can't enforce every device to reregister.
Idea to enable scavanging on zone is useless - as long as I will not run it on server level this setting is useless.
The only way is to remove stale records tracked by timestamp distributted accross thirty domain controllers (in four domains). We can recognize records from workstations (laptops, pc and virtual desktops) by ip addresses, but why it can be automated?

default ttl dns records on Windows

The 20 minute TTL is default with self update

The default of 20 minutes - set by DWORD named DefaultRegistrationTTL in HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters (the value should be in seconds). A reboot or ipconfig /registerdns.

prevent domain controller dns registration srv records

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
REG_MULTI_SZ value: DnsAvoidRegisterRecords

Enter: Ldap LdapAtSite Pdc Gc GcAtSite GcIpAddress DcByGuid Kdc KdcAtSite Dc DcAtSite Rfc1510Kdc Rfc1510KdcAtSite GenericGc GenericGcAtSite Rfc1510UdpKdc Rfc1510Kpwd Rfc1510UdpKpwd
Enter: Ldap LdapAtSite Pdc Gc GcAtSite GcIpAddress DcByGuid Kdc KdcAtSite Dc DcAtSite Rfc1510Kdc Rfc1510KdcAtSite GenericGc GenericGcAtSite Rfc1510UdpKdc Rfc1510Kpwd Rfc1510UdpKpwd
Domain Controllers
LdapIpAddress A
Ldap SRV _ldap._tcp.
DcByGuid SRV _ldap._tcp..domains._msdcs.
Kdc SRV _kerberos._tcp.dc._msdcs.
Dc SRV _ldap._tcp.dc._msdcs.
Rfc1510Kdc SRV _kerberos._tcp.
Rfc1510UdpKdc SRV _kerberos._udp.
Rfc1510Kpwd SRV _kpasswd._tcp.
Rfc1510UdpKpwd SRV _kpasswd._udp.

Global Catalog
Gc SRV _ldap._tcp.gc._msdcs.
GcIpAddress A gc._msdcs.
GenericGc SRV _gc._tcp.
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/76bc11f0-8bc2-4d6c-a643-328f479aae1b

DNS performance on Windows

Just to remember: I've got experience with heavy loaded domain controller with queries rate above 40k per second (yes, 40 thousand per second). The main problem on this virtual domain controller it was high cpu0 utilization and low load on other cpu. As I can remember - it was VMWare vm with 16 cores (virtual cores on operating system). What should be done in this case to improve performance? Upgrade of virtual hardware and network subsystem.

_kerberos-master - how to point *nix systems to domain controllers

_kerberos-master - SRV record by design is not registered in Active Directory/DNS, but many *nix systems tries to locate this record. I can register single or multiple records (to use round-robin) and point *nix systems to selected domain controllers in Active Directory.
And... it is not exactly true. *nix systems tries to locate this record only just in case when password is wrong and this _kerberos-master domain controller should have the freshest password in the network. For me - almost every domain controller receiving passwords in the same time. We have two sites, but there is no wait before replication. On both production domains we have low number of domain controllers so srv record is only for *nix systems, to ensure them, that they have all required data.
Currently we will have fresh servers from *nix family in domain so it will be very useful and better configured.

dnscmd - records from command line

DNSCMD dns1.my.internal.domain /RecordAdd my.internal.domain newhost CNAME orighost.my.internal.domain.

DNSCMD dns1.my.internal.domain /RecordAdd my.internal.domain newhost.my.internal.domain. CNAME orighost.my.internal.domain.

DNSCMD dns1.my.internal.domain /RecordAdd my.internal.domain A 10.1.1.17

Of course small/capital letters are not important - only for better understanding. Why to use DNSCMD still? Because not everywhere I can use PowerShell to register record and in this way it is much simpler than using GUI console of course.

TMG DNS cache - draft

Dim root
Set root = CreateObject("FPC.Root")

'Declare the other objects that are necessary.
Dim array ' An FPCArray object
Dim settings ' An FPCLowLevelSettings

' Get references to the array object and to the low-level
' settings object.
Set array = root.GetContainingArray
Set settings = array.ArrayPolicy.LowLevelSettings

WScript.Echo "DNS cache settings:" & vbCrLf & _
" TTL of entries for unsuccessful lookups: " & _
settings.DnsCacheNegativeTtl & vbCrLf & _
" Maximum size of a single record: " & _
settings.DnsCacheRecordMaxKB & vbCrLf & _
" Maximum size of the Firewall service DNS cache: " & _
settings.DnsCacheSize
The following VBScript code sets a new value for the DnsCacheNegativeTtl property: ' Create the root object.

Dim root
Set root = CreateObject("FPC.Root")

'Declare the other objects that are necessary.

Dim Policy ' An FPCArrayPolicy object

' Get an array policy object and set the new value of the
' DnsCacheNegativeTtl property of the low-level
' settings object.

Set Policy = root.GetContainingArray.ArrayPolicy
Policy.LowLevelSettings.DnsCacheNegativeTtl = 7200

Policy.Save

WScript.Echo "Done!"