Information
A zone transfer, or AXFR request, is a mechanism commonly used by DNS deployments to replicate zone information from master/primary servers to slave/secondary servers. BIND can be configured to respond only to AXFR requests that originate from a predefined server. This is made possible by the allow-transfer option in named.conf. It is recommended that the fulfillment of zone transfer requests be reserved for only predefined slave/secondary servers.
Rationale:
A zone transfer is not something you want most systems to be able to request, as it would give out the entire list of resource records. There should be very few systems besides the slave name servers that need to be able to perform a zone transfer for your domains. Allow-transfer specifies who can request a zone transfer. Restrictions should not be made using IP address, but rather by using TSIG keys.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
1. Add a similar configuration to named.conf on the master server.
2. Configure each slave to include its keys and add a statement to named.conf so that the slave will sign its communications to the master.