I remember moving to djbdns forever ago in my ISP days because bind was such a security nightmare and configuration footgun.