A network administrator is configuring a secondary DNS server to replicate all zone records from the primary DNS server. During testing, standard name resolution queries work correctly, but the full zone transfer between the two servers fails. Which port and transport protocol combination must the administrator ensure is permitted through the firewall to allow the zone transfer to succeed?