I would like to use a box in our DMZ running 2003 DNS server as a hidden
master for some domains we have registered.

Let's call is ns.master.com

I know to only have the publicly accessible DNS servers listed at the
root servers, and as NS records on the zone.

So I'd have:

ns0.provider.com
ns1.provider.com
ns2.provider.com

The provider (provider.com) we use is configured to query for updates
from a specified IP address for each domain (that of ns.master.com).

The master is configured to allow zone transfers for their IP address.

They don't support notification so it's disabled on ns.master.com for
each domain.

What should I set the SOA records to?

I guess if I want a fully hidden master I would set it to
ns0.provider.com rather than ns.master.com - but I'm not sure if it
would break anything?

TIA,
Paul
--
paul@spamcop.net