To make my question even simpler: I find lines in named.log like: client 192.168.1.1#3597: updating zone 'acme.com/IN': deleting an RR What RR was it? Any way to find out? Martin McCormick