Cannot add Conditional Forwarder in Active Directory

Answer found, and it's a bit unpleasant (at least if you were expecting the people creating management packs to actually know what they are doing).

Extracted from the monitor's description:

This monitor verifies forwarder availability by performing an NSLOOKUP on the targeted forwarder.

The script executes nslookup -timeout=<value> -querytype=<type> <name> <server>

<type> is A, NS, SOA.

<name> is target DNS name to resolve. If unconditional forwarder, the override value is used else the forwarder domain name is used.

<server> is the name of the server where the NSLOOKUP query occurs.
The value is $Target/Property[Type="DNS!Microsoft.Windows.DNSServer.Library.Server"]/ListeningIP$ which provides a listing of all IP addresses that the current DNS server is listening on.

<value> is timeout seconds/3 because timeout seconds is used to set the maximum time the script can run.

Unconditional Forwarder Example: NSLOOKUP -timeout=30 -querytype=a www.microsoft.com 10.0.0.5 would query server 10.0.0.5 for the DNS name for www.microsoft.com. In this case, you would set the actual timeout seconds to 90 monitor override.

Conditional Forwarder Example: NSLOOKUP -timeout=30 -querytype=a www.msn.com 10.0.0.5 would query server 10.0.0.5 for the actual name of the conditional forwarder targeted by this monitor.

What this means is that the SCOM agent will try to perform queries like these ones:

nslookup -timeout=30 -querytype=a domainB.dom <server>
nslookup -timeout=30 -querytype=a someotherzone.local <server>
nslookup -timeout=30 -querytype=a 0.0.10.in-addr.arpa <server>

This would work for the main AD domain's DNS zone (because DCs automatically register themselves as empty A records for that zone), but would fail for "someotherzone.local", which didn't have any empty A record (I can confirm that, after manually creating one, the alert disappeared and the monitor returned to green).

The third query, of course, would always fail, because it just doesn't make any sense at all to look for an A record in a reverse lookup zone.

Resolution: override the DNS Forwarder Availability Monitor to perform a NS or SOA query for the forwarded zone instead of an A query.
Which is what it should have been doing from the very beginning.

As you know, AD Integrated zones are stored in AD and therefore are replicated along the same schedule. Inter-site replication occurs by default every three hours but can be configured to as little as 15 minutes (I can't think of a reason not to go down to 15 minutes, anyone?)

Although relatively miniscule, there is a second, shorter interval to be aware of. After the data has replicated to the DC, the DNS service must read this data from the local directory. How often this is done is based on the DsPollingInterval value, which defaults to three minutes.

So the latency is Inter-site replication interval + DsPollingInterval. In a default environment, the maximum latency is as long as 183 minutes.

References:

1. Absolute must-read on how AD replication works: http://technet.microsoft.com/en-us/library/cc755994%28WS.10%29.aspx
2. Great post describing DsPollingInterval: https://blogs.technet.com/b/askpfeplat/archive/2013/03/22/mailbag-how-often-does-the-dns-server-service-check-ad-for-new-or-modified-data.aspx?Redirected=true