With the release of bind 9.16.11, the bind-chrootenv subpackage is obsolete.
Rather, protection is implemented through systemd's protection mechanism:
* the servers are run with "ProtectSystem=strict", thus prohibiting the
  service to write to arbitrary file system locations.
* Writing is only permitted to
  - /var/lib/named
  - /var/run
For further restrictions/protection mechanisms refer to the
named.service unit files.
For now your existing configuration will still work, but please take the following steps
to make sure the configuration still works with all future versions:
* In /etc/sysconfig/named remove 'createNamedConfInclude' from NAMED_INITIALIZE_SCRIPTS
* Comment out or remove the line 'include "/etc/named.conf.include";' in /etc/named.conf
* Include everything mentioned in /etc/sysconfig/named: NAMED_CONF_INCLUDE_FILES
  directly in /etc/named.conf e.g. like this: 'include "/etc/named.d/rndc-access.conf";'
