Domain – Windows 7 — cannot join domain. Network ID grayed out

It took forever to find where it was happening, but it turns out that there were filters within the VPN blocking LDAP (and other) traffic. I cleared those filters and now it's working.

When you create an rDNS zone for the parent network 10.220 the DNS service will automatically create a child zone under the parent zone for each subnet of the parent zone (network) that it discovers when clients from those subnets register their PTR records. You've wound up with delegated zones under the parent zone because the DNS service has discovered that you've already created zones for those subnets so it creates a delegated zone under the parent zone that points to your manually created zones.

The way I prefer to do it is to create a rDNS zone for the parent network and let the DNS service create the child zones when clients from those subnets register their PTR records. This is the opposite of what you've done so let me clarify:

If you want to manually create zones for each subnet then don't create a zone for the parent network (10.220).

If you want the DNS server to create the child zones for the subnets that fall under the 10.220 network/DNS zone then delete the 10.220.0 and 10.220.1 zones that you manually created.