So I now have a setup where #ixfrdist sits in front of #powerdns so that secondaries can do IXFRs. But - ixfrdist only supports IP-based ACLs, it can't do TSIG. So maybe I need to use BIND after all 😩