From: Mark Andrews <marka@isc.org>
Date: Wed, 12 Aug 2026 03:21:35 +0000 (+1000)
Subject: Document built in check-name exclusions
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1efb00ded3d4788d9d63bb976ce6ff581e42c564;p=thirdparty%2Fbind9.git

Document built in check-name exclusions

The Active Directory Forest prefix (gc._msdcs) A and AAAA record
and the RFC7208 exclusion lookup names (interior labels on _spf,
_spf_verify, and _spf_rate) for A records are automatically excluded
from check-names.
---

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 8009fffd81c..cbe42d6913a 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -2630,6 +2630,14 @@ Boolean Options
    owner name indicates that it is a reverse lookup of a hostname (the
    owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
 
+   Owner names of A and AAAA records starting with the Active
+   Directory Forest prefix labels ``gc._msdcs`` are excluded if the
+   remainder of the name meets the check-names rules.
+
+   Owner names of A records meeting the :rfc:`7208` rules for the
+   labels ``_spf``, ``_spf_verify`` and ``_spf_rate`` are also
+   excluded.
+
 .. namedconf:statement:: check-dup-records
    :tags: dnssec, query
    :short: Checks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS.