A shared private hosted zone must be resolvable in another account VPC. The zone exists, but the consumer VPC receives NXDOMAIN. Which cross-account setup is needed?

1. Add the consumer account ID as a TXT record in the zone.
2. Create a public NS delegation to the private hosted zone servers.
3. Authorize the association in the zone account and associate the consumer VPC with the zone.
4. Open the consumer instance security group to all public DNS sources.