After trying to join Windows 10 workstation to a Samba 3 domain, I finally found, after reading more of similar problems, that Windows 10, when asked to join the domain, indeed queries DNSonly for the AD _ldap record for the domain.
There was no explicit announcement about dropping Samba 3 domain (and Windows Server 2016 joined that domain without any problems) - only this subtle change that can be found only by trying.
Can someone from Microsoft confirm that the NT domain support has indeed been officially dropped at or after version 1709 of Windows 10?