Dns updating software
At the same time, I'm combing through AD and rationalizing group memberships.
The Dns Update Proxy group, despite its description, had a domain admin account and the BES Service Account as members.
The DHCP service needs some valid way to tell the DNS server to update the records.
Dynamic updates are set to Secure Only, and Aging is 2 hours no-refresh, 6 hours refresh intervals.
Under the SOA tab, the refresh interval is 15 minutes, retry is 10, and the expiration is 1 day. There are no DNS events in the log which suggest that something is set up wrong.
I also read that a service account should be configured to carry out the zone updates - which I have now done. The Dns Update Proxy group should contain the computer accounts of your DHCP servers, so DC1 and DC2 in your case.
In DNS console, find an outdated record, go to the Security tab and take a look at the owner of the record.