[2005] explain how ACL rules apply

diff --git a/doc/guide/bind10-guide.xml b/doc/guide/bind10-guide.xml
index c65ca8ac93639f9ed66b469b4e4d36f286f8fad7..b0619c5d4d9d29074b6c64c44ceaf13a96c4b100 100644 (file)
--- a/doc/guide/bind10-guide.xml
+++ b/doc/guide/bind10-guide.xml
@@ -2141,6 +2141,14 @@ DDNS/zones[0]/update_acl[1]     {"action": "ACCEPT", "from": "::1", "key": "key.
           should have a TSIG key in its constraints.
       </simpara></note>
 
+      <para>
+       The ACL rules will be checked in the listed order, and the
+       first matching one will apply.
+       If none of the rules matches, the default rule will apply,
+       which is rejecting any requests in the case of
+       <command>b10-ddns</command>.
+      </para>
+
       <para>
         Currently update ACL can only control updates per zone basis;
         it's not possible to specify access control with higher