macOS Server 10.12.6 documentation says that we should prevent arbitrary zone transfers out of our DNS server, and that the way to do this is to firewall port 53 for anyone not on our LAN, with specific exceptions for our secondary DNS servers.
What they don't mention is that port 53 is where all DNS traffic goes, so firewalling that port also shuts off our DNS services for anyone on the road. Yes, we have VPN connections; no, they're not enforced and we don't want to start.
So the question then becomes: 1) how do we instruct the server to make a distinction between transfers and plain old DNS requests; 2) if that were simple, why doesn't the Apple documentation say to do that? I poked around and found the instructions to do this with plain old BIND anywhere but a Mac—and it's the same file the documentation told me to edit two weeks ago to fix a different security issue.
My next step is to edit the file, try to attack my own server, and if it fails, mark this as done. In which case I can come back and answer my own question. But this requires figuring out how to do a zone transfer attack—and it leaves me back at square one if I follow the vanilla BIND instructions and it doesn't work. Anyone have any ideas?