I used the instructions on the following link to set up DNS auditing on Server 2003: http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx
It works. When ever a forward lookup zone entry gets created or deleted, there is a log entry in the security event log.
I am investigating reverse lookup zones (PTR records) and I needed to set up auditing for that but it seems as if deleting those does not add any thing to the security log. Does any one know how I can set up auditing for reverse lookup zones so that a log entry is created whenever an entry is created or deleted?