Question: where do domain controllers get their time from?
Answer: The domain controller with the PDCe role should sync with an external, reliable time source. This could be an internet time server, a hardware time-keeping device, or an internal NTP server that isn't part of the domain. From there, the other domain controllers in the domain will sync their time from the PDCe.