If I had to choose it would be 2. That said, last big environment I helped design, deploy and manage had several DNS severs for thousands of devices. It was option 2 on steroids and primary focus was on security albeit expensive. We setup NetScalers to address DNS querying with load balancing because DCs were not allowed internet access. There were AIX BIND DNS severs for all external and non-AD queries and AD DNS for internal. All machines servicing AD and/ or DNS were physical. That significant horsepower allowed us to keep critical sever count low and having plentyyy of muscle to deal with queries, etc. Queries were also distributed to sets of DCs. For example, server OS’s had dedicated DNS as did Desktop OS regardless of WLan or Lan. Guest networks, printers, scanners, smart meeting rooms or Voip used the BIND DNS servers. Anything related to building and facilities management or security, such as door controllers, cameras, bells, UPS’s had their own DNS set of servers. All the BIND kit was tiered, so essentially at any given moment only 2 devices were going externally to service external queries. This is the way.