2.3.2.23 msDNS-KeymasterZones

The msDNS-KeymasterZones attribute MUST contain a list of distinguished names for all of the directory service-integrated zones for which the DNS server is the key master.