How can I find devices still using the old domain controllers for DNS?

Capture DNS traffic on the old controllers or enable DNS debug logging, then work through the source IPs that are still sending queries. That gives you a starting point for identifying devices and changing their settings.

I'd monitor for longer than a day or two if equipment only comes online occasionally. Pick a window that covers the longest normal equipment cycle you know about, and check the logs periodically rather than assuming a quiet day means everything is clear.

A temporary DNS forwarder on the old address is another option once the old controller has been demoted. Log the requests and forward them to the new DNS servers while you track down the remaining clients.

Test it before relying on it, and treat it as a transition rather than a permanent fix. It keeps the old address in the picture, so you'll still need an owner and a retirement plan for it.

I wouldn't add a second NIC to a domain controller just to catch stragglers. Multiple interfaces can complicate address registration and client connectivity. Logging on the old DNS server is a cleaner first step while it is still available.

Don't limit the retirement check to DNS queries. Some systems may have the old controller address configured for LDAP or another service, so DNS logs alone won't catch every dependency.

Also review the domain controller DNS records after demotion and remove any stale records that remain. That's separate from finding clients with hardcoded DNS settings, but worth checking before calling the migration finished.

A shutdown test might expose missed clients, but it's a rough choice when a factory machine could be affected. Monitoring first gives you a chance to fix those devices without deliberately interrupting them.

For future changes, consider DHCP reservations where the equipment supports DHCP. That can make address management easier than configuring every device by hand.