So…come morning the stale record that wouldn’t go away seems to be gone. Still unclear on why it persisted so long after the whole zone was replaced but at least the zone is intact and the TXT values are sane.
Solution: Don’t use ZS as master DNS
Not a great solution, but a solution. Still interested in any light that can be shed on this behaviour – the + character being stripped – I presume that’s the web interface getting in the way, the stale record persisting in responses from slave long after replaced and the services restarted, and there’s much higher zone transfer latency now. Previously I never saw serials out of sync at the slaves, now it seems to be a norm when I make a zone alteration.
Replacement master is an MS DNS