It would be nice if my secondaries could transfer zones.

I needed to open TCP/53.  That got lost in the refactoring
of the firewall rules.