allow-transfer

[Jonathan de Boyne Pollard]

L> If dns.isp.com is one of the NS records in the zone file,
L> should I still config allow-transfer in the named.conf?
L>                 IN      NS      dns.aaa.com.
L>                 IN      NS      dns.isp.com.

You are thinking of Microsoft's DNS server.  Microsoft's DNS server is 
the one with the third option of using whatever is in the "NS" resource 
record set at the "zone" apex to restrict "zone transfer" access.  BIND 
only has the two options of allowing either anyone or only a 
specifically named set of addresses given in the configuration file to 
have "zone transfer" access.