diff --git a/bin/named/server.c b/bin/named/server.c
index 64a5180..41a1826 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -3376,10 +3376,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
		dns_acache_setcachesize(view->acache, max_acache_size);
	}

-	CHECK(configure_view_acl(vconfig, config, ns_g_config,
-				 "allow-query", NULL, actx,
-				 ns_g_mctx, &view->queryacl));
-
	/*
	 * Make the list of response policy zone names for a view that
	 * is used for real lookups and so cares about hints.
@@ -4258,9 +4254,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
	INSIST(result == ISC_R_SUCCESS);
	view->trust_anchor_telemetry = cfg_obj_asboolean(obj);

-	CHECK(configure_view_acl(vconfig, config, ns_g_config,
-				 "allow-query-cache-on", NULL, actx,
-				 ns_g_mctx, &view->cacheonacl));
	/*
	 * Set sources where additional data and CNAME/DNAME
	 * targets for authoritative answers may be found.
@@ -4287,22 +4280,40 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
		view->additionalfromcache = ISC_TRUE;
	}

+	CHECK(configure_view_acl(vconfig, config, ns_g_config,
+				 "allow-query-cache-on", NULL, actx,
+				 ns_g_mctx, &view->cacheonacl));
+
	/*
-	 * Set "allow-query-cache", "allow-recursion", and
-	 * "allow-recursion-on" acls if configured in named.conf.
-	 * (Ignore the global defaults for now, because these ACLs
-	 * can inherit from each other when only some of them set at
-	 * the options/view level.)
+	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
+	 * and "allow-recursion-on" ACLs if configured in named.conf, but
+	 * NOT from the global defaults. This is done by leaving the third
+	 * argument to configure_view_acl() NULL.
+	 *
+	 * We ignore the global defaults here because these ACLs
+	 * can inherit from each other.  If any are still unset after
+	 * applying the inheritance rules, we'll look up the defaults at
+	 * that time.
	 */
-	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
-				 NULL, actx, ns_g_mctx, &view->cacheacl));
+
+	/* named.conf only */
+	CHECK(configure_view_acl(vconfig, config, NULL,
+				 "allow-query", NULL, actx,
+				 ns_g_mctx, &view->queryacl));
+
+	/* named.conf only */
+	CHECK(configure_view_acl(vconfig, config, NULL,
+				 "allow-query-cache", NULL, actx,
+				 ns_g_mctx, &view->cacheacl));

	if (strcmp(view->name, "_bind") != 0 &&
	    view->rdclass != dns_rdataclass_chaos)
	{
+		/* named.conf only */
		CHECK(configure_view_acl(vconfig, config, NULL,
					 "allow-recursion", NULL, actx,
					 ns_g_mctx, &view->recursionacl));
+		/* named.conf only */
		CHECK(configure_view_acl(vconfig, config, NULL,
					 "allow-recursion-on", NULL, actx,
					 ns_g_mctx, &view->recursiononacl));
@@ -4340,18 +4351,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
		 * the global config.
		 */
		if (view->recursionacl == NULL) {
+			/* global default only */
			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
						 "allow-recursion", NULL,
						 actx, ns_g_mctx,
						 &view->recursionacl));
		}
		if (view->recursiononacl == NULL) {
+			/* global default only */
			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
						 "allow-recursion-on", NULL,
						 actx, ns_g_mctx,
						 &view->recursiononacl));
		}
		if (view->cacheacl == NULL) {
+			/* global default only */
			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
						 "allow-query-cache", NULL,
						 actx, ns_g_mctx,
@@ -4365,6 +4379,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
		CHECK(dns_acl_none(mctx, &view->cacheacl));
	}

+	if (view->queryacl == NULL) {
+		/* global default only */
+		CHECK(configure_view_acl(NULL, NULL, ns_g_config,
+					 "allow-query", NULL,
+					 actx, ns_g_mctx,
+					 &view->queryacl));
+	}
+
	/*
	 * Ignore case when compressing responses to the specified
	 * clients. This causes case not always to be preserved,