Add allow-transfer statement which disallows zone transfer by default.

bind/files/debian/named.conf.local

@@ -25,6 +25,11 @@ zone "{{ key }}" {
   {%- endfor %}
   };
   {%- endif %}
+  allow-transfer {
+  {% for remote in args.get('allow-transfer', {}) %}
+    {{ remote }};
+  {% endfor %}
+  };
   {% if args['type'] == "master" -%}
     {% if args['notify'] -%}
   notify yes;

pillar.example

@@ -25,6 +25,9 @@ bind:
     1.168.192.in-addr.arpa:
       type: master
       notify: False
+      allow-transfer:
+        - 1.1.1.1
+        - 2.2.2.2 
     dynamic.domain.com:
       type: master
       allow-update: "key core_dhcp"