I have a bind cluster with private/public records stored in (2) views and configured with TSIG. Standard slave operation works but I'd like to use dig to transfer the zones for troubleshooting/testing.
Typically I'd use
dig example.com @ns1.example.com -y tsig-key:SECRETCODE however this is denied as the key is only assigned to the view public.
Reproduce: Attempt a dig axfr from a client in the internal view.
dig AXFR example.com -y external:xxxxxxxx
dig AXFR example.com -y internal:xxxxxxxx