This option specifies the list of IPs denied to ask for dns zone transfer from bind DLZ module. The IP list is comma and space separated and specified in the same syntax as used in , specifically including IP address, IP prefixes and IP address masks. As this is a DNS server option, hostnames are naturally not permitted. If a client identified in this list sends a zone transfer request, it will always be denied, even if they are in . This allows the definition of specific denied clients within an authorized subnet. 192.168.0.1