diff --git a/nixos/boxes/colony/vms/estuary/dns.nix b/nixos/boxes/colony/vms/estuary/dns.nix
index 3c9614d..189bfc2 100644
--- a/nixos/boxes/colony/vms/estuary/dns.nix
+++ b/nixos/boxes/colony/vms/estuary/dns.nix
@@ -114,8 +114,12 @@ in
         ];
         also-notify = [ "127.0.0.1" ];
         allow-axfr-ips = [
+          "127.0.0.0/8" "::1/128"
           "216.218.133.2" "2001:470:600::2"
-        ];
+        ]
+        ++ lib.my.c.home.routersPubV4
+        ++ lib.my.c.as211024.trusted.v4
+        ++ lib.my.c.as211024.trusted.v6;
         enable-lua-records = true;
         #loglevel = 7;
         #log-dns-queries = true;
diff --git a/nixos/boxes/home/routing-common/dns.nix b/nixos/boxes/home/routing-common/dns.nix
index f08b03f..bc1a8cf 100644
--- a/nixos/boxes/home/routing-common/dns.nix
+++ b/nixos/boxes/home/routing-common/dns.nix
@@ -170,6 +170,12 @@ in
           "0.0.0.0:5353" "[::]:5353"
         ];
         also-notify = [ "127.0.0.1" ];
+        allow-axfr-ips = [
+          "127.0.0.0/8" "::1/128"
+          allAssignments.estuary.internal.ipv4.address
+        ]
+        ++ lib.my.c.as211024.trusted.v4
+        ++ lib.my.c.as211024.trusted.v6;
         enable-lua-records = true;
         # loglevel = 7;
         # log-dns-queries = true;