Are AD names with more than one dot legal

Your best bet is to look at the netlogon.dns file from the %SystemRoot%\system32\config folder of a clientdomain.local domain controller and base your standard primary zone on that information. Edit the IP addresses in that file to match your NAT'd subnet (Who came up with 6.6.200.0/24, anyway? I guess you'll probably never need to talk to the US Army, eh?), remove any references to DCs you don't want to talk to from the hosted environment, and create the appropriate records in a standard primary zone on a hosted.local DNS server. That should get you what you need. Just remember that, if significant changes occur in the clientdomain.local domain you may need to re-import the file.

For the domain itself you'll want an "@" host record (blank hostname) for each of the IP addresses of the DCs that should resolve for the domain's name. (In the DNS records created by the Netlogon service all of the IPs assigned to all of the DCs would be listed in the "@" record for the domain. You can get by with fewer, though.)

You should only need DNS resolution for the AD domain name itself, not for specific zones or RR's in the zones. You need to isolate the problem to either a name resolution problem (DNS) or to a communication problem (firewall).

Rather than using host files, the recommended configuration is to set up conditional forwarders for each domain in the opposing domain's DNS servers (DNS serverA in domainA has a conditional forwarder to DNS serverB for domainB).

From each domain run nslookup and query for the other domain (domain.tld). Nslookup should return the IPv4 and IPv6 ip addresses for the DNS servers for that domain (which are probably also the DC's for that domain, unless you've split the DNS role off of the DC's). If nslookup works then DNS resolution is OK and you should look at the firewall as the likely culprit.