GSLB behind MS DNS

We are implementing new FortiADCs at two sites, mainly for various apps to use GSLB.  We have DNS on Windows Servers and want to keep it that way and are trying to figure out the best way to point clients to the ADCs.  What has worked best for everyone else?

We have kicked around a new zone with a conditional forwarder, but we have quite a bit of ssl and we would have to redo the certificates with new SNs, so that's not ideal.

I'm thinking a single DNS record like apps.internaldomain.local pointing to the ADC might work best instead of the zone and then the ADC do the rest of the work.  Are there any caveats that I'm not thinking of?