What do you consider a best practice for retaining/releasing unnecessary domain names? In this case, specialized domains tied to marketing campaigns.  While the expense is small and there is some possibility for a bad actor to acquire and use for malicious activity, I question keeping domains of this sort "forever." How do you handle this?

Cost for maintenance and retention should not come from the IT budget, but from the department who most benefits from the domain. This is usually marketing.

Often the reason they want to retain a domain is because they are not the ones paying for it. Transfer that cost (including the cost of keeping it secure) back on them and you'll very quickly get a view on what's priority and what's vanity. 

We have a policy to keep such domain names for two years after they are no longer needed. If no additional use for them is identified and we are reasonably sure no reputational damage would occur if someone else registered and used them for malicious intent, we let them go. Otherwise, we retain them and review letting them go annually.