Implemented solution is "dumb" variant as described in https://www.redhat.com/archives/freeipa-devel/2012-May/msg00047.html.

Note for testers:
It is necessary to test behaviour after change in ordinary DNS record and change in DNS zone record separately, but any change in DNS-representable data should be enough. You can add/delete/change arbitrary record (TXT is perfectly fine).

SOA serial will not increment after change in zone record if changed attribute do not represent DNS data, e.g. change in idnsAllowDynUpdate attribute will not trigger SOA serial update.
It is perfectly fine, because this attribute is not transferred to slave servers.

In other words: You can initiate zone transfer with dig -t AXFR @master_IP zone.name.test and see what is transferred. SOA serial should be incremented if you change any value which is part of zone transfer (except serial itself).

Verified using:
ipa-server-3.0.0-8.el6.x86_64


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: bz840383 - Implement SOA serial number increments for external changes
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [13:40:06] ::  Executing: ipa dnszone-add --name-server=ipaqavmh.testrelm.com. --admin-email=ipaqar.redhat.com --serial=11 --refresh=303 --retry=101 --expire=8 --minimum=33 --ttl=55 zone840383.testrelm.com
  Zone name: zone840383.testrelm.com
  Authoritative nameserver: ipaqavmh.testrelm.com.
  Administrator e-mail address: ipaqar.redhat.com.
  SOA serial: 11
  SOA refresh: 303
  SOA retry: 101
  SOA expire: 8
  SOA minimum: 33
  SOA time to live: 55
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;
:: [   PASS   ] :: Add a new zone to test with
:: [13:40:07] ::  Executing: ipa dnsrecord-add zone840383.testrelm.com txt --txt-rec "bug test"
  Record name: txt
  TXT record: bug test
:: [   PASS   ] :: add record type txt
:: [13:40:09] ::  Executing: ipa dnszone-mod zone840383.testrelm.com --allow-transfer='any;'
  Zone name: zone840383.testrelm.com
  Authoritative nameserver: ipaqavmh.testrelm.com.
  Administrator e-mail address: ipaqar.redhat.com.
  SOA serial: 1353091209
  SOA refresh: 303
  SOA retry: 101
  SOA expire: 8
  SOA minimum: 33
  Active zone: TRUE
  Allow query: any;
  Allow transfer: any;
:: [   PASS   ] :: Allow zone transfers
:: [13:40:11] ::  Executing: dig @10.16.98.193 -t AXFR zone840383.testrelm.com | grep "TXT" 
txt.zone840383.testrelm.com. 86400 IN	TXT	"bug" "test"
:: [   PASS   ] :: Verify the TXT record is part of zone transfer
:: [13:40:12] ::  Executing: ipa dnsrecord-mod zone840383.testrelm.com txt --txt-rec="bug test" --txt-data="Bug Test for 840383"
  Record name: txt
  TXT record: Bug Test for 840383
:: [   PASS   ] :: update record type txt
:: [   PASS   ] :: new serial after updating record is higher. Was: 1353091209; New: 1353091213
:: [13:40:14] ::  Executing: ipa dnszone-mod --dynamic-update=true zone840383.testrelm.com
  Zone name: zone840383.testrelm.com
  Authoritative nameserver: ipaqavmh.testrelm.com.
  Administrator e-mail address: ipaqar.redhat.com.
  SOA serial: 1353091213
  SOA refresh: 303
  SOA retry: 101
  SOA expire: 8
  SOA minimum: 33
  Active zone: TRUE
  Dynamic update: TRUE
  Allow query: any;
  Allow transfer: any;
:: [   PASS   ] :: Update idnsAllowDynUpdate attribute
:: [   PASS   ] :: serial was not updated when idnsAllowDynUpdate attr was updated 
'f1001af6-b4c1-4e3e-a6fe-7db3dc68e44f'
bz840383-Implement-SOA-serial-number-increments-for-external-changes result: PASS
   metric: 0
   Log: /tmp/beakerlib-9193278/journal.txt
    Info: Searching AVC errors produced since 1353091205.84 (Fri Nov 16 13:40:05 2012)
     Searching logs...
     Info: No AVC messages found.
 Writing to /mnt/testarea/tmp.zW6ING
:
   AvcLog: /mnt/testarea/tmp.zW6ING

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0359.html