The zone option allow_notify was documented in defaults/main.yaml but never rendered by named.conf.views.j2. Any allow_notify list configured for a zone was silently dropped, so secondaries kept accepting NOTIFY messages only from the hosts listed in the masters statement. In addition, the allow_query_on block emitted the statement name allow-query instead of allow-query-on. This produced a second allow-query clause in the same zone and thereby overrode the interface restriction that was actually intended. Co-authored-by: Copilot <copilot@github.com>