[Samba] The need for Kerberos dynamic DNS updates

[Doug Meredith]

The "Dns-backend bind" page on the wiki recommends that you set up DNS
dynamic updates via Kerberos.  My understanding is that if you select
BIND9_DLZ that the DNS zone data is stored in the directory.  I would
assume that in this case the normal directly replication would take care of
moving DNS changes to all AD DCs.  If this is correct, it would seem that
there would be no need for a DNS-specific update mechanism.

Is there something that I have misunderstood?

Doug