From explanation it looks like a normal case of using a single administrator user credentials for all infrastructure which most of the people do to avoid inconvenience.
If you see the problem here, it's very simple to understand that an administrator account of Domain Controller was used to access an SQL Database server and for which you were able to extract the ticket. Now when it comes to recommendations I'd advise as follows.
These are general recommendations which should be taken care by every administrator.
Use of Local Administrator Account should be preferred instead of Domain Administration Account's password being sprinkled everywhere. If somebody can do this for every server they would save themselves from such incidents.
All the servers (at the minimum) should be set to "Not Cache Credentials" This can be done from Computer Configuration\Windows Settings\ Security Settings\Local Polices\Security Options\Interactive Logon: Number of previous logons to cache. Set it to 0.
The problem with point 2 would be that if AD isn't available users might not be able to login. So here is a bit of trade off that should be considered.
- Administrators should use separate accounts for their administrative tasks.
What other recommendations are there?
I have shared above.
Use credential guard to protect against dumping of kerberos tickets
Yes this should be used and It is also recommended to have a proper SIEM tool and configured in a way to detect such attempts so proper actions can be taken in time.
What is the correct/secure way to log onto the DC? I assume a jumpbox?
Follow the above recommendations and Jumpbox is one additional layer that can be used.