Cruiser

Have looked at DNS security settings today and everything looks OK - domain and enterprise admins only. Anyone have any more ideas?

Will check zone. We have already taken the DNS role off the old server

Yes definitely!

Not from a client that I know of. The record on the DNS server just changes when it restarts.....

We have changed over to a new DNS server. Every time that server gets restarted however, the record for the OLD server is changed to show the IP address for the new server. ie. old server has IP ending .20, new has IP ending .22 - after restart forward lookup zone records for both show .22 address I am no expert at DNS. Please can anyone help? I feel it's something left on the old server as the event log shows DNS server events still...