This has been solved. The secret is to remove any reference to the external DNS on all interfaces. I had to add the internal DNS as the only address on the external Airport connection. Now all functions work: AD credentials work for webpage login, and I’m able to browse the Internet, and Software Update Server continues to receive the updates from Apple. I was able to make the Ethernet interface the primary interface and it still works!
Doing the Happy Dance…