What is the toughest part about being a DNS administrator?

I don't think understanding PTR record is too hard.But some people say that: "DNS Security  like DNS Spoofing/DNS cache poisoning is a challange" Other people might found Classless Reverse Zone Delegation.
It is important for each and every DNS administrator that which OS is he/she using for DNS server.Setting up and configure a DNS is very easy but troubleshooting a DNS may be a bit harder.
   

In DNS, The hardest part to understand about PTR records for inexperienced DNS administrators is delegation.
For forward zones, the domain is registered using a domain registrar, and the registrar is told to "point" the domain to a particular server.
This is delegation.
In the case of reverse zones, the situation is similar, except that instead of a registrar delegating the zone, it's usually the ISP that creates the delegation.
Or doesn't, in many cases, leaving the operator of the subnet unable to effectively create PTR records.
In such cases, the operator of the subnet must rely on the controller of the reverse zone to manage the PTR records properly.
The key point is that having control over a domain and a subnet doesn't give control over the reverse zone for that subnet.
It's up to whoever assigns the subnet to also assign control of the reverse zone, or decide not to do so.
In the case of subnets smaller than a class C, RFC2317 provides a method of delegating control of the PTR records.