dns and domain controller - issue in request rounting

Hello

I have a DC and some clients. Clients has my SG ip address as DNS server. My SG has 2 request routing entries:

xxx.168.192.in-addr.arpa → servername

domain.local → servername

all works fine (both internet browsing and network shares) except for the password management. In this scenario, user can login in his pc even if the password is expired. Then, when he tries to access to a shared folder, windows tells that the password has expired. In other situation I see that windows continues to tell user that new password does not meet the minimum requirements, but it is not true (also with 15 char mixed with numbers, symbols... )

If the client has DC ip address as DNS server, these issues dont' happen.

So my question is: is there any other settings I need to configure in my scenario? I want to have all my clients to point to SG ip for DNS server, instead of my DC ip address.

Thanks