I'm assuming that you've got a UCS master joined to an AD as a member server. On UCS the Univention Directory Connector is used for syncing objects from the AD to the UCS LDAP. The connector only synchronizes users, groups and computer accounts but not anything else from the AD, especially the DNS objects.
For this to work you would have to configure the bind name server on the UCS server manually to be a slave for the zone(s) you want to synchronize. This is outside of the scope of what a UCS provides tools for (meaning you cannot configure this scenario via the Univention Management Console), but you can modify the files /etc/bind/local.conf and /etc/bind/local.conf.proxy and set up the appropriate controls for slave mode operation there. Of course the AD has to allow zone transfers from your UCS DC.
You can check the config registry variable »server/role«, either from the Univention Management Console or from the CLI with »ucr get server/role«.
You've said that you have a »UCS Backup«. I think you're confusing terms here. Note that there are two sets of distinct roles: one that applies to the Active Directory Domain, one that applies to the UCS domain.
In an AD domain there are no primary/secondary/master/backup DCs. Either a server is a DC or it isn't. All DCs are equal regarding their functionality and rights.
In a UCS domain you have exactly one (UCS-)DC master, zero or more DC backups (for purposes of converting the DC backup to the DC master should the DC master suffer a catastrophic and permanent failure; usually either no DC backup or exactly one), zero or more DC slaves (for purposes of having a local LDAP directory available close by, e.g. you could have one DC slave in a branch office connected to the main location only via a slow or unreliable connection), zero or more member servers.
The server roles in an UCS domain do not really map to the server role in an AD domain.
A UCS DC master may be an AD DC, too. Or not.
A UCS DC backup may be an AD DC, too. Or not.
It all depends on the installation mode.
For example, if you have an AD with Windows-based DCs and you join your first UCS server into such a domain then that UCS server will have to be the UCS DC master (as only the master can run the AD connector mentioned above), and that UCS DC master will not be an AD DC at all.
On the other hand, if you don't have any Windows AD DCs then you can have your UCS DC master be an AD DC, too, as can be your UCS DC backup.