bind: client X... zone transfer 'example.com/AXFR/IN' denied, but allow-transfer { X; }; is set!

I get access denied when trying to initiate zone transfer.

For a dig @ns.example.com example.com axfr i'm getting

client 71.252.219.43#58392: zone transfer 'balticovo.eu/AXFR/IN' denied

Configuration:

1. Server is NATed, behind firewall. If it would be firewalls issue, i wouldn't see in my computer log files that there such a request has been made.
2. named process runs as bind user which is chrooted in /var/lib/named.

3. named.conf:

   web:/var/lib/named/etc# cat named.conf
   options {
       directory "/etc";
       pid-file "/var/run/named.pid";
       statistics-file "/var/run/named.stats";
       allow-transfer { 127.0.0.1; };
       listen-on port 53 { any; };
       listen-on-v6 port 53 { any; };
   };
   
   logging {
       category default { default_syslog; default_debug; };
       category unmatched { null; };
   
       channel default_syslog {
           syslog daemon;
           severity info;
       };
   
       channel default_debug {
           file "named.run";
           severity dynamic;
       };
   
       channel default_stderr {
           stderr;
           severity info;
       };
   
       channel null {
           null;
       };
   };
   
   zone "." {
       type hint;
       file "/etc/root.hints";
   };
   
   zone "localhost" {
       type master;
       file "/etc/localhost";
   };
   
   zone "0.0.127.in-addr.arpa" {
       type master;
       file "/etc/127.0.0";
   };
   
   zone "example.com" IN {
           type master;
           file "sites/example.com/forward.zone";
           allow-transfer { 202.157.182.142; 71.252.219.43; };
           allow-update { none; };
           allow-query { any; };
           zone-statistics yes;
   };   
   

4. All files are owned by bind. And the named process truly runs by the chrooted user.
5. Digging other than axfr record works.
6. named -v outputs BIND 9.6-ESV-R3