Hunted down some weird Active Directory replication problem, and guess what? Yep, it was DNS (it's always DNS)