FortiGate as a Secondary DNS Server for Active Directory

In my homelab, I run a single Active Directory domain controller. It holds the AD-integrated DNS zone and, until recently, my DHCP server too. It is a VM on a Proxmox node. When it goes down, every client loses DNS resolution and internet access, because the DC forwards everything it is not authoritative for to my ISP's resolvers.