DNS Express and CNAMES to AWS servers

It seems to me that your DNS Express deployment should be an authoritative published master to handle queries from the external world only, which is really the purpose of DNS Express, while your internal users should configure their DNS resolver to point the AD, the hidden master. I would even want to have a dedicated Linux box hosting a BIND server to handle internal queries to resolve external domains, in which case you configure the AD to forward such queries to the BIND server.