diff --git a/debian/control b/debian/control
index 5b05cc8..cf387af 100644
--- a/debian/control
+++ b/debian/control
@@ -10,7 +10,7 @@ Uploaders: Steve Langasek <vorlon@debian.org>,
 Homepage: http://www.samba.org
 Standards-Version: 4.4.1
 Build-Depends: bison,
-               debhelper-compat (= 11),
+               debhelper-compat (= 12),
                dh-exec,
                dh-python,
                docbook-xml,
diff --git a/debian/patches/0011-DLZ-bind-zone-transfer-restriction.patch b/debian/patches/0011-DLZ-bind-zone-transfer-restriction.patch
new file mode 100644
index 0000000..cc10456
--- /dev/null
+++ b/debian/patches/0011-DLZ-bind-zone-transfer-restriction.patch
@@ -0,0 +1,72 @@
+From: Benjamin Bohard <bbohard@cadoles.com>
+Date: Mon, 30 Dec 2019 10:38:47 +0100
+Subject: DLZ bind zone transfer restriction
+
+---
+ .../smbdotconf/domain/dnszonetransferclients.xml   | 19 ++++++++++++++++
+ source4/dns_server/dlz_bind9.c                     | 26 +++++++++++++++++++++-
+ 2 files changed, 44 insertions(+), 1 deletion(-)
+ create mode 100644 docs-xml/smbdotconf/domain/dnszonetransferclients.xml
+
+diff --git a/docs-xml/smbdotconf/domain/dnszonetransferclients.xml b/docs-xml/smbdotconf/domain/dnszonetransferclients.xml
+new file mode 100644
+index 0000000..3529e60
+--- /dev/null
++++ b/docs-xml/smbdotconf/domain/dnszonetransferclients.xml
+@@ -0,0 +1,19 @@
++<samba:parameter name="dns zone transfer clients"
++                 context="G"
++                 type="cmdlist"
++                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
++<description>
++       <para>This option specifies the list IPs authorized to ask for dns zone
++           transfer.
++       </para>
++
++       <para>The content is a comma-separated list of IP addresses.
++       </para>
++
++       <para>Default is "none", meaning no transfer will be authorized.
++       </para>
++</description>
++
++<value type="default">none</value>
++<value type="example">192.168.0.1</value>
++</samba:parameter>
+diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c
+index 5f9a71d..eb4703c 100644
+--- a/source4/dns_server/dlz_bind9.c
++++ b/source4/dns_server/dlz_bind9.c
+@@ -938,7 +938,31 @@ _PUBLIC_ isc_result_t dlz_allowzonexfr(void *dbdata, const char *name, const cha
+ 	/* just say yes for all our zones for now */
+ 	struct dlz_bind9_data *state = talloc_get_type(
+ 		dbdata, struct dlz_bind9_data);
+-	return b9_find_zone_dn(state, name, NULL, NULL);
++        isc_result_t ret ;
++        const char **authorized_clients ;
++        unsigned int i ;
++ 
++        /* check that the zone is known */
++        ret = b9_find_zone_dn(state, name, NULL, NULL);
++        if (ret == ISC_R_SUCCESS) {
++                authorized_clients = lpcfg_dns_zone_transfer_clients(state->lp) ;
++                if (authorized_clients) {
++                        state->log(ISC_LOG_INFO, "samba_dlz: checking if client is authorized for zone transfer") ;
++ 
++                        /* if the option is not set, default is to accept all transfers
++                           if the option is set, default is to accept only the selected IPs */
++                        ret = ISC_R_NOPERM ;
++                        for (i = 0; authorized_clients && authorized_clients[i] ; i++) {
++                                state->log(ISC_LOG_INFO, "samba_dlz: comparing to %s", authorized_clients[i]) ;
++                                if (strcmp(authorized_clients[i], client) == 0) {
++                                        state->log(ISC_LOG_INFO, "samba_dlz: accepting IP %s", client) ;
++                                        ret = ISC_R_SUCCESS ;
++                                        break ;
++                                }
++                        }
++                }
++        }
++        return ret ;
+ }
+ 
+ /*
diff --git a/debian/patches/series b/debian/patches/series
index 6086f87..c0b2226 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -20,3 +20,5 @@ CVE-2020-10704-5.patch
 CVE-2020-10704-6.patch
 CVE-2020-10704-7.patch
 CVE-2020-10704-8.patch
+0011-DLZ-bind-zone-transfer-restriction.patch
+
