diff --git a/authoritative-dns.nix b/authoritative-dns.nix
index 6f1bad2..08d6d6f 100644
--- a/authoritative-dns.nix
+++ b/authoritative-dns.nix
@@ -92,10 +92,12 @@ in {
       stateDirectory = cfg.state-directory;
       zones = let
         forwardZones = mapAttrs' (domain:
-          { ksk, zone, ... }:
+          { ksk, zone, nameservers, ... }:
           nameValuePair "${domain}." {
             dnssec = ksk.key-file != null;
             ksk.keyFile = ksk.key-file;
+            provideXFR = map (ns: "${ns}/32 NOKEY") nameservers;
+            notify = map (ns: "${ns} NOKEY") nameservers;
             data = zoneToZonefile {
               inherit domain;
               inherit (cfg) timestamp;
@@ -103,7 +105,7 @@ in {
             };
           }) cfg.domains;
         reverseZones = concatMapAttrs (domain:
-          { ksk, zone, reverse-zones, ... }:
+          { ksk, zone, nameservers, reverse-zones, ... }:
           listToAttrs (map (network:
             reverseZonefile {
               inherit domain network;
diff --git a/reverse-zone.nix b/reverse-zone.nix
index 168bb4b..b198070 100644
--- a/reverse-zone.nix
+++ b/reverse-zone.nix
@@ -54,6 +54,8 @@ let
 in nameValuePair "${getNetworkZoneName network}" {
   dnssec = keyFile != null;
   ksk.keyFile = keyFile;
+  provideXFR = map (ns: "${ns}/32 NOKEY") nameservers;
+  notify = map (ns: "${ns} NOKEY") nameservers;
   data = ''
     $ORIGIN ${getNetworkZoneName network}
     $TTL ${toString zoneTTL}