diff -ur orig/pdns-2.9.17/modules/gmysqlbackend/gmysqlbackend.cc pdns-2.9.17/modules/gmysqlbackend/gmysqlbackend.cc
--- orig/pdns-2.9.17/modules/gmysqlbackend/gmysqlbackend.cc	2005-06-24 16:55:07.247656000 -0400
+++ pdns-2.9.17/modules/gmysqlbackend/gmysqlbackend.cc	2005-06-24 16:55:29.039343528 -0400
@@ -75,6 +75,7 @@
     declare(suffix,"info-all-master-query","", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare(suffix,"delete-zone-query","", "delete from records where domain_id=%d");
     declare(suffix,"zone-serial-query","", "select max(change_date) from records where domain_id=%d");
+    declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
 
 
   }
diff -ur orig/pdns-2.9.17/modules/gpgsqlbackend/gpgsqlbackend.cc pdns-2.9.17/modules/gpgsqlbackend/gpgsqlbackend.cc
--- orig/pdns-2.9.17/modules/gpgsqlbackend/gpgsqlbackend.cc	2005-06-24 16:55:07.248656000 -0400
+++ pdns-2.9.17/modules/gpgsqlbackend/gpgsqlbackend.cc	2005-06-24 18:03:25.635606696 -0400
@@ -74,6 +76,7 @@
     declare(suffix,"info-all-master-query","", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare(suffix,"delete-zone-query","", "delete from records where domain_id=%d");
     declare(suffix,"zone-serial-query","", "select max(change_date) from records where domain_id=%d");
+    declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
 
 
   }
diff -ur orig/pdns-2.9.17/modules/gsqlitebackend/gsqlitebackend.cc pdns-2.9.17/modules/gsqlitebackend/gsqlitebackend.cc
--- orig/pdns-2.9.17/modules/gsqlitebackend/gsqlitebackend.cc	2005-06-24 16:55:07.249656000 -0400
+++ pdns-2.9.17/modules/gsqlitebackend/gsqlitebackend.cc	2005-06-24 16:55:29.041343224 -0400
@@ -76,6 +76,7 @@
     declare( suffix, "info-all-master-query", "", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare( suffix, "delete-zone-query", "", "delete from records where domain_id=%d");
     declare( suffix, "zone-serial-query", "", "select max(change_date) from records where domain_id=%d");
+    declare( suffix, "check-acl-query", "", "select value from acls where acl_type='%s' and acl_key='%s'");
   }
   
   //! Constructs a new gSQLiteBackend object.
diff -ur orig/pdns-2.9.17/pdns/backends/gsql/gsqlbackend.cc pdns-2.9.17/pdns/backends/gsql/gsqlbackend.cc
--- orig/pdns-2.9.17/pdns/backends/gsql/gsqlbackend.cc	2005-06-24 16:55:07.251655000 -0400
+++ pdns-2.9.17/pdns/backends/gsql/gsqlbackend.cc	2005-06-24 18:38:07.385132664 -0400
@@ -239,6 +239,7 @@
   d_InfoOfAllMasterDomainsQuery=getArg("info-all-master-query");
   d_DeleteZoneQuery=getArg("delete-zone-query");
   d_ZoneSerialQuery=getArg("zone-serial-query");
+  d_CheckACLQuery=getArg("check-acl-query");
 }
 
 
@@ -344,6 +345,28 @@
   return false;
 }
 
+bool GSQLBackend::checkACL(const string &acl_type, const string &key, const string &value)
+{
+
+  string format;
+  char output[1024];
+  format = d_CheckACLQuery;
+  snprintf(output, sizeof(output)-1, format.c_str(), sqlEscape(acl_type).c_str(), sqlEscape(key).c_str());
+  try {
+    d_db->doQuery(output, d_result);
+  }
+  catch(SSqlException &e) {
+    throw AhuException("Database error trying to check ACL:"+acl_type+" with error: "+e.txtReason());
+  }
+  if(!d_result.empty()) {
+    for (int i = 0; i < d_result.size(); i++) {
+      if (d_result[i][0] == value)
+        return true;
+    }
+  }
+  return false; // default to false
+}
+
 bool GSQLBackend::createSlaveDomain(const string &ip, const string &domain, const string &account)
 {
   string format;
diff -ur orig/pdns-2.9.17/pdns/backends/gsql/gsqlbackend.hh pdns-2.9.17/pdns/backends/gsql/gsqlbackend.hh
--- orig/pdns-2.9.17/pdns/backends/gsql/gsqlbackend.hh	2005-06-24 16:55:07.252655000 -0400
+++ pdns-2.9.17/pdns/backends/gsql/gsqlbackend.hh	2005-06-24 16:55:29.045342616 -0400
@@ -33,6 +33,7 @@
   bool feedRecord(const DNSResourceRecord &r);
   bool createSlaveDomain(const string &ip, const string &domain, const string &account);
   bool superMasterBackend(const string &ip, const string &domain, const vector<DNSResourceRecord>&nsset, string *account, DNSBackend **db);
+  bool checkACL(const string &acl_type, const string &key, const string &value);
   void setFresh(u_int32_t domain_id);
   void getUnfreshSlaveInfos(vector<DomainInfo> *domains);
   void getUpdatedMasters(vector<DomainInfo> *updatedDomains);
@@ -68,5 +69,6 @@
   string d_InfoOfAllMasterDomainsQuery;
   string d_DeleteZoneQuery;		
   string d_ZoneSerialQuery;
+  string d_CheckACLQuery;
 
 };
diff -ur orig/pdns-2.9.17/pdns/dnsbackend.hh pdns-2.9.17/pdns/dnsbackend.hh
--- orig/pdns-2.9.17/pdns/dnsbackend.hh	2003-08-23 10:35:35.000000000 -0400
+++ pdns-2.9.17/pdns/dnsbackend.hh	2005-06-24 16:55:29.089335928 -0400
@@ -169,6 +169,11 @@
     return false;
   }
 
+  virtual bool checkACL(const string &acl_type, const string &key, const string &value)
+  {
+    return false;
+  }
+
 protected:
   bool mustDo(const string &key);
   const string &getArg(const string &key);
diff -ur orig/pdns-2.9.17/pdns/tcpreceiver.cc pdns-2.9.17/pdns/tcpreceiver.cc
--- orig/pdns-2.9.17/pdns/tcpreceiver.cc	2003-11-08 07:25:29.000000000 -0500
+++ pdns-2.9.17/pdns/tcpreceiver.cc	2005-06-24 18:03:25.406641504 -0400
@@ -253,6 +254,15 @@
   if( arg()["allow-axfr-ips"].empty() || d_ng.match( (struct sockaddr_in *) &q->remote ) )
     return true;
 
+  SOAData sd;
+  sd.db=(DNSBackend *)-1;
+  if(s_P->getBackend()->getSOA(q->qdomain,sd)) {
+    DNSBackend *B=sd.db;
+    if (B->checkACL(string("allow-axfr"), q->qdomain, q->getRemote())) {
+      return true;
+    }
+  }
+
   extern CommunicatorClass Communicator;
 
   if(Communicator.justNotified(q->qdomain, q->getRemote())) { // we just notified this ip 
