Dynamic Update Is Set to "None" for a DNS Root Zone

For Active Directory-integrated zones, the default value for the "Dynamic update" setting is "Allow Only Secure Updates."

The exception to this is the default value for Active Directory-integrated root (or ".") zones. For these zones, the default value is "None."

This behavior is by design because the root zone should not undergo dynamic changes.