I had assumed the 'security' tab in the zone properties controlled who/what was allowed to create dynamic records for the zone, with the "create all child objects" right. However, my recently ...