update docs about not putting NSEC/NSEC3 in the database

git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@2916 d19b8d6e-7fed-0310-83ef-9ca221ded41b

diff --git a/pdns/docs/pdns.xml b/pdns/docs/pdns.xml
index aab67d69204d8b428f0a8909d1fd672afa2385ae..77747b121673e51a5de339574387f82dc7a4670a 100644 (file)
--- a/pdns/docs/pdns.xml
+++ b/pdns/docs/pdns.xml
@@ -11791,6 +11791,10 @@ $ pdnssec rectify-zone powerdnssec.org
        If your frontend does not add empty non-terminal names to records, you will get DNSSEC replies of 3.1-quality, which has served many people well, but we
        suggest you update your code as soon as possible!
   </para>
+  <para>
+       If you import presigned zones into your database, please do not import the NSEC or NSEC3 records. PowerDNS will synthesize these itself. Putting
+       them in the database might cause duplicate records in responses. zone2sql filters NSEC and NSEC3 automatically.
+  </para>
   </section>
 </section>
   <section id="dnssec-security"><title>Security</title>