There are 4 main errors the test zone transfer utility may return, each of which indicates a different set of potential problems to check on.

connect failed: No route to host
This error indicates that our nameservers are unable to connect to your primary nameserver due to a connection or network problem of some sort. If you are familiar with troubleshooting connection or network problems you may be able to find the problem using tools such as traceroute. Otherwise you will want to contact the company providing connectivity for your nameserver regarding the issue.

connect failed: Connection refused
This indicates that while we can make a connection to your primary, the connection is refused by either the nameserver or firewall. This is most likely an issue with the ACL not being recognized by the firewall, or that the nameserver software is not running on your primary, or is incorrectly configured and refusing connections.

transfer refused
This indicates that the primary nameserver is refusing to transfer the zone files to our secondaries. This would typically be caused by our ACL not being used on the primary to grant permission to our nameservers to do zone transfers.

not authoritative for ...
In this case we can connect and there are no permissions problems with the transfer, but there is a problem in the zone file that prevents it from being transferred. There are several problems with a zone file which would invalidate it, preventing the transfer.