Most admins I talk to run DNS on their Domain Controllers, and most also run DHCP on one or more of them as well. The benefits of AD-Integrated Zones and the small footprint of DHCP allow you to run these services on your DC's with minimal impact on performance. The risk lies in the way DNS registrations are handled.

If the DC's computer account is not included in the DNSUpdateProxy group, all registrations in DNS are "owned" by the DC If the DC computer accounts are included, no ownership is assigned. This stands for DNS registrations performed by the DHCP and Netlogon services. It is possible to assign a user account to register all DHCP related DNS registrations. From a command prompt type:

netsh dhcp server set dnscredentials {username} {domainname} {password} n

et stop DHCPServer

net start DHCPServer

Now all DNS registrations triggered by the DHCP service will be performed with this user account instead of the DC's computer account.

For more information see:

Article ID: 242468 - How to Use the Netsh.exe Tool and Command-Line Switches