DNS disaster and how can stop it for future

Question

Hi
Last week, I found lots of static records were deleted automatically from DNS server console which cuased lots of P1 in my environment.
I found some below envents before the time when issue occurred.
I want  to know why DNS randomely Host reocrds were deleted automatically. Even opned case with MS but could not get anything from MS that why this was happened.
finally we resotred the DNS zones from backup tool and after restoring everythying was working fine.
please see some below events:
=================
Log Name:      Directory Service
Source:        NTDS ISAM
Date:          12/29/2013 12:01:00 AM
Event ID:      2001
Task Category: (16)
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      DC101.prise.med.org
Description:
NTDS (528) NTDSA: Shadow copy instance 31 freeze started.
=
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          12/29/2013 12:05:22 AM
Event ID:      2094
Task Category: Replication
Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      DC101.prise.med.org
Description:
Performance warning: replication was delayed while applying changes to the following object. If this message occurs frequently, it indicates that the replication is occurring slowly and that the server may have difficulty keeping up with changes.
Object DN: CN=1 All Workstations_resultset_0_0\0ADEL:b6a014b6-ef00-459b-ae1e-f948bb38af2f,CN=Deleted Objects,DC=prise,DC=med,DC=org
Object GUID: b6a014b6-ef00-459b-ae1e-f948bb38af2f
Partition DN: DC=prise,DC=med,DC=org
Server: 1cdbccca-a84c-4095-ba55-1504137ef9c5._msdcs.med.org
Elapsed Time (secs): 17
User Action
A common reason for seeing this delay is that this object is especially large, either in the size of its values, or in the number of values. You should first consider whether the application can be changed to reduce the amount of data stored on the object,
or the number of values.  If this is a large group or distribution list, you might consider raising the forest functional level to Windows Server 2003 or greater, since this will enable replication to work more efficiently. You should evaluate whether
the server platform provides sufficient performance in terms of memory and processing power. Finally, you may want to consider tuning the Active Directory Domain Services database by moving the database and logs to separate disk partitions.
If you wish to change the warning limit, the registry key is included below. A value of zero will disable the check.
Additional Data
Warning Limit (secs): 10
Limit Registry Key: System\CurrentControlSet\Services\NTDS\Parameters\Replicator maximum wait for update object (secs)
=======
Log Name:      Directory Service
Source:        NTDS ISAM
Date:          12/29/2013 12:36:03 AM
Event ID:      510
Task Category: Performance
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DC101.prise.med.org
Description:
NTDS (528) NTDSA: A request to write to the file "D:\Windows\NTDS\ntds.dit" at offset 1731624960 (0x0000000067368000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (62 seconds) to be serviced by the OS. In addition, 6 other
I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 160409 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance
diagnosing the problem.
====
Log Name:      Directory Service
Source:        NTDS ISAM
Date:          12/31/2013 12:57:49 AM
Event ID:      509
Task Category: Performance
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DC101.prise.med.org
Description:
NTDS (528) NTDSA: A request to read from the file "D:\Windows\NTDS\ntds.dit" at offset 967688192 (0x0000000039adc000) for 16384 (0x00004000) bytes succeeded, but took an abnormally long time (107 seconds) to be serviced by the OS. In addition, 7 other
I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 1328 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance
diagnosing the problem.
=
Log Name:      Directory Service
Source:        NTDS ISAM
Date:          12/31/2013 12:59:14 AM
Event ID:      510
Task Category: Performance
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DC101.prise.med.org
Description:
NTDS (528) NTDSA: A request to write to the file "D:\Windows\NTDS\ntds.dit" at offset 978018304 (0x000000003a4b6000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (84 seconds) to be serviced by the OS. In addition, 148 other
I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 84 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance
diagnosing the problem.
==
Log Name:      File Replication Service
Source:        NtFrs
Date:          12/30/2013 7:08:20 AM
Event ID:      13508
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DC101.prise.med.org
Description:
The File Replication Service is having trouble enabling replication from  DC110 to DC101 for d:\windows\sysvol\domain using the DNS name DC110.prise.med.org. FRS will keep retrying.
 Following are some of the reasons you would see this warning.
 [1] FRS can not correctly resolve the DNS name SHINFRPEMDC110.prise.med.org from this computer.
 [2] FRS is not running on  MDC110.prise.med.org.
 [3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

Answer 1

Did you ever run dnscmd /ageallrecords, if yes, it will enable aging & scavenging on the static records too by setting the timestamps value on it. I would also suggest to review the below two article.
http://blogs.technet.com/b/askpfeplat/archive/2013/10/12/who-moved-the-dns-cheese-auditing-for-ad-integrated-dns-zone-and-record-deletions.aspx
http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just-be-patient.aspx
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.