.. namedconf:statement:: allow-update
+ A simple access control list.
When set in the ``zone`` statement for a primary zone, this specifies which
hosts are allowed to submit Dynamic DNS updates to that zone. The
default is to deny updates from all hosts.
^^^^^^^^^^^^^^^^^^^^^^^
BIND 9 supports two methods of granting clients the right to
-perform dynamic updates to a zone, configured by the ``allow-update``
-or ``update-policy`` options. In both cases, BIND 9 writes the updates
-to the zone's filename set in ``file``.
+perform dynamic updates to a zone:
-.. namedconf:statement:: allow-update
+- :namedconf:ref:`allow-update` - a simple access control list
+- :namedconf:ref:`update-policy` - fine-grained access control
- The ``allow-update`` clause is a simple access control list. Any client
- that matches the ACL is granted permission to update any record in the
- zone.
+In both cases, BIND 9 writes the updates
+to the zone's filename set in ``file``.
.. namedconf:statement:: update-policy