Source: https://paper.bobylive.com/Security/CIS/CIS_ISC_BIND_DNS_Server_9_11_Benchmark_v1_0_0.pdf