When attempting to protect a DNS Zone, something directly under either the Forward or Reverse Lookup Zones, the name is not present in the dialog window. Rather, it is listed simply as "Zone".
Once selected and added, the Object Canonical name reflects the proper name of the object.
The zones are listed alphanumerically, so generally the Reverse Lookup Zones will come first, followed by the Forward Lookup Zones. Add groups of them at a time (SHIFT+Click and CTRL+Click are allowed) and then remove those that do not apply.
Enhancement Request TF00457240 has been created to consider addressing this in a future release of Change Auditor.