Clarify relationship between ACLs and RPZ

In the ARM section about RPZ, add text explicitly stating that ACLs take
precedence over RPZ to prevent users from expecting RPZ actions to be
applied to queries coming from clients which are not permitted access to
the resolver by ACLs.

(cherry picked from commit 33bddbb5d18e17e909142c9a01d893da963697a7)

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 5565b601a364a0dce320d9efa4544086a06e9f12..9bf100fa40064e52f24108d27d7babad24d6d2ea 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -9889,6 +9889,14 @@ deny-answer-aliases { "example.net"; };
            than that is a configuration error.
          </para>
 
+         <para>
+           Rules encoded in response policy zones are processed after
+           <link linkend="access_control">Access Control Lists
+           (ACLs)</link>.  All queries from clients which are not
+           permitted access to the resolver will be answered with a
+           status code of REFUSED, regardless of configured RPZ rules.
+         </para>
+
          <para>
            Five policy triggers can be encoded in RPZ records.
            <variablelist>