DNS Errors in WIN2K ActDir Network

I have 7 clinics all running win2K with Act Dir (installed and configured by a system integegrator we fired for being inept).  They are all connected via T-1 VPN's.  DNS is configured as Caching/A.D Integrated with all 7 clinics pointing to the corporate location for resolution (making 8 sites totall).  The Corporate server (also win2K) is also caching/ADIntegrated and points to the outside world via the DNS entry's to the default top-level Internet root servers, plus three more entries - 2 for the external DNS servers provided by our ISP and one entry pointing to our DNS/WEB hosting service (register.com).  There are also static entries for all the primary servers/services within our private network.

Question Part (A) - is this a valid configuration, or is there a better way to provide Internal DNS services to both internal and external addresses from Win2K/ActDir???

Part (B) - The REAL Problem - we have routine problems with our DNS.  They typically manifest in one of three scenarios:

#1 - People inside will sometimes loose DNS resolution to the outside world - they pull up a web site, it won't resolve so the browser say's unable to display, or page not found etc. etc. - and they e-mail me saying the network is down (no irony lost on the fact that they use the network to report it's supposed failure!).  I have followed this closely, and there is not a pattern that I can see.  The resolution is to wait (it will come back, typically after 20-30 mintues - sometimes more), re-boot thier computer (works sometimes, not always) reboot their local server (works most of the time - but not 100%).

#2 - People inside will loose DNS resolution internally - they can no longer get to our servers they could earlier.  Typically, re-booting solves this one, but again I don't think it's 100% (but admit am not certain).  ALSO - another variation of this is when they request a service from a remote location (i.e. TermServe to the corporate site) they can be refused (in this case terminal services will state that it cannot validate thier logon).

#3 - When I check ActDir sync logs I notice that there are lots of problems resolving DNS server entries internally - so synchonization is sporadic.  It succeeds enough to keep the network functioning for the most part, but does appear to be hindering a smooth running network.

For now I find that simply re-booting all the servers on a routine basis (twice a week generally) will keep things running fairly well.

But there is obviously a serious problem with the existing setup.

CAN ANYONE PLEASE Advise a better solution, or at least what to change to make this work reliably?

As background info - all sites are connnected via VPN's using cisco PIX, and T1's.  The network is a subnetted in standard Class-3 format using the 172.16... range.  Physicall link is good - we typically transfer several gig per day agregated across all links (moving large CT, MRI, 3D-rendering, etc.).

Each of the servers own network settings points to itself as first DNS, and then to the corporate server as alternative.  The corporate server points to itself first, and then to the primary ISP's DNS server.  However, within the DNS utility on the corporate server the forwarding servers are as described above - root DNS for Internet, local IPS's DNS then register.com - our registrar and DNS/WEB provider.  All client's are WinXP, and point to the local win2K server as primary, and then the corporate as alternative.

The outside world only needs to see our web and e-mail sites - those addresses are static and managed by register.com.  Internally there are also static addresses that point to the web-site (hosted externally) and internal e-mail access.

If you need any more info I'm happy to provide.

Thanks for your help - this site is a life-saver!