God dammit! I typo-ed a manual #DNS zone update to serial 2925112700 instead of 2025112700.

Fortunately, I know the fix for this because I have done this once before about 25 years ago.

You set the serial number in the SOA to the highest possible value, which is 2^32-1, or 4294967295. Push that to the secondaries, and then reload the zone again with the proper serial number.

It's like that episode of Futurama where they can't go backwards in time, so they rollover to the end of the universe, only to discover that it starts all over again.