Hi, are encrypted zone transfers (and TSIG + source IP ACLs) supported by PowerDNS by running dnsdist with DoT in front of an authoritative NS? thanks, Christoph https://dnsprivacy.org/implementation_status/#xfrxot-implementation-status https://www.rfc-editor.org/rfc/rfc9103 https://datatracker.ietf.org/doc/rfc8945/