You need to ensure that only the client computers in the Active Directory domain can register records in the contoso.com zone