Clarify how to print default dnssec-policy

Reading the source tree is unnecessarily complicated, we now have
command line option to print defaults.

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 9dfda0f6fcac9bbfd2e9ca30f4fd90c7a4dae5d5..a1b3e2e2a71c79f490329c81a5f880b99dd7544b 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -6388,10 +6388,9 @@ propagating DS updates.
 
 .. _dnssec_policy_default:
 
-Policy ``default`` causes the zone to be signed with a single combined-signing
-key (CSK) using algorithm ECDSAP256SHA256; this key has an unlimited
-lifetime.  (A verbose copy of this policy may be found in the source
-tree, in the file ``doc/misc/dnssec-policy.default.conf``.)
+The policy ``default`` causes the zone to be signed with a single combined-signing
+key (CSK) using the algorithm ECDSAP256SHA256; this key has an unlimited
+lifetime. This policy can be displayed using the command :option:`named -C`.
 
 .. note:: The default signing policy may change in future releases.
    This could require changes to a signing policy when upgrading to a