I Hate Active Directory
The [temporary] fix was to change Apache's configuration to reference IP addresses instead of names for the Plone redirects. I guess this means the blame rests with DNS somewhere.
This probably ties into the DNS issues Jeff was talking about earlier (he was getting bounces for valid email domains saying "domain not found").
It's probably about time to move DNS off alfalfa and ActiveDirectory to something that will work better. We can still let AD take care of internal DHCP->DNS mappings, but control everything else with a different DNS server.