Which step would be needed before creating a policy that would block DNS zone transfers while allowing DNS queries to pass?

DNS zone transfers use TCP. DNS queries use UDP.
Which step would be needed before creating a policy that would block DNS zone transfers
while allowing DNS queries to pass?

A.
Create a custom service using UDP port 53 as the source port.

B.
Create a custom service using TCP port 53 as the destination port.

C.
Do nothing, the pre-defined DNS service will work properly as defined.

D.
The predefined DNS service does not allow this type of configuration.