It is non-obvious for authoritative BIND views

Your example is not enough to properly configure an authoritative server (although it is good
enough for a recursion-only cache server, I think).

The proper configuration for an authoritative BIND server ends up requiring the use of views
if you also need it to be a recursive server for some clients, I think.

For the authoritative view, you need:

        additional-from-auth no;
        additional-from-cache no;

as well as the more obvious:
        recursion no;

Otherwise, you are still a problem for others (DoS amplifier at the very least).