NS1 offers authentication using TSIG (Transaction Signature) when being used as a secondary zone. This feature is currently exclusive to the V2 Portal platform.
Configuring A Secondary Zone
(Enact the first 5 steps from this article https://ns1.com/articles/secondary-zones )
Before completing the new zone, you will need to select enable TSIG. The next step is to supply a type of hash, a name for the key being created and the key itself. The key works as a password to authenticate communication between the two DNS servers (AXFR) to securely transfer changes for zone records. The hash type and key will need to match between the primary and secondary DNS providers.
Once completed, save the new zone. The secondary zone will be created in a "pending" state -- it may take a few minutes for the first synchronization against your primary server.