wheel - 1:28 pm on Jun 21, 2011 (gmt 0)
One thing I did that helped was to install a tool called dnstop on my nameserver. Then I ran "dnstop eth0 -l 3". That works kind of like 'top' on linux, but shows you what domains are being queried. Interestingly, another domain I thought wasn't taking much traffic looks to also be getting some queries, so I may offload that domain as well.