I have a Windows Server 2008R2 Active Directory and Exchange 2010 server (client access, hub transport and mailbox roles) in a primarily Linux server environment. A Linux server running BIND9 is master for all zones, including AD specific ones, with updates allowed from the Windows server (and from a separate Linux DHCP server). A linux/postfix mail transport acts as the domain MX server and a smart relay for the Exchange server.
The Windows server is exchange.domain.tld (type= authoritative) but also has a type="internal relay" accepted domain within Exchange for domain.tld.
THE PROBLEM: The Windows server updates the DNS with itself as the A record for domain.tld - which it certainly isn't. This breaks DNS lookups for the company web server. I'm currently working around this by removing update access to domain.tld but leaving it in place for the AD specific subdomains, but this generates many errors (Event ID 5774) in the Windows server event log.
Additionally, the Windows server has a second NIC which connects to a private IP address range (used for a VOIP telephony system), and this address is also being set as an A record for domain.tld
Is there a way to limit/control what the Windows server updates? Any alternate suggestions about how to structure DNS in this environment would also be welcome.