doc: warn about NTAs outside zone cuts

We just ran into that in the val_ta_sentinel_insecure.rpl test.

diff --git a/daemon/README.rst b/daemon/README.rst
index 1244b69b0df5b1100155bf1bc7db7e32b7c6a251..3ed2b8f41cbe607f27680f45837757cdd0b350d9 100644 (file)
--- a/daemon/README.rst
+++ b/daemon/README.rst
@@ -596,6 +596,9 @@ Trust anchors and DNSSEC
       [1] => bad.boy
       [2] => example.com
 
+   .. warning:: If you set NTA on a name that is not a zone cut,
+      it may not always affect names not separated from the NTA by a zone cut.
+
 .. function:: trust_anchors.add(rr_string)
 
    :param string rr_string: DS/DNSKEY records in presentation format (e.g. ``. 3600 IN DS 19036 8 2 49AAC11...``)