I use mod_xsend version 0.12 and downloaded from https://tn123.org/mod_xsendfile/ (update link).

Apparently some things have changed since the INSTALL text was written.

In the file directory you need to insert at the beginning of its .htacess:

XSendFile on
Deny from all

This directory has to be under the document root of drupal and its the file system has to be set to private, its xsend module installed and enabled. That's all that is needed to get it working.