doc: add mention about policy debug logging near RPZ

diff --git a/modules/policy/README.rst b/modules/policy/README.rst
index a769a692171f815bcc2106a5909b76b56ec7d986..176ff1638d0594c2dc24d3e7c600a7aac9f8387d 100644 (file)
--- a/modules/policy/README.rst
+++ b/modules/policy/README.rst
@@ -640,6 +640,15 @@ Response policy zones
   .. [#] Our :any:`policy.DROP` returns *SERVFAIL* answer (for historical reasons).
 
 
+  .. note::
+
+     To debug which domains are affected by RPZ (or other policy actions), you can enable the ``policy`` log group:
+
+     .. code-block:: lua
+
+        log_groups({'policy'})
+
+
 .. function:: rpz(action, path, [watch = true])
 
   :param action: the default action for match in the zone; typically you want :any:`policy.DENY`