Any zone that uses the Active Directory driver is returning a 0 for the TTL when reading the zone for diffing. This results in all the AD records being replaced every time dnscontrol is run.

E.g: [Step 1/1] MODIFY A example.com: (10.7.3.28 0) -> (10.7.3.28 300)