Clarify XoT usage and warn about the unauthenticated mode

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 2a851361c0726dcfa8a0704f496554a4f5cb95f6..9faafb90f4238fadf6066efcf38187538ebc055a 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -886,6 +886,18 @@ used by multiple stub and secondary zones in their ``primaries`` or
 keyword ``masters``, which can still be used, but is no longer the
 preferred terminology.)
 
+To force the zone transfer requests to be sent over TLS, use ``tls`` keyword,
+e.g. ``primaries { 192.0.2.1 tls tls-configuration-name; };``,
+where ``tls-configuration-name`` refers to a previously defined
+:ref:`tls statement <tls>`.
+
+.. warning::
+
+   Please note that TLS connections to primaries are currently
+   **not authenticated**. This mode provides protection from passive observers
+   but does not protect from man-in-the-middle attacks on zone transfers.
+
+
 .. _options_grammar:
 
 ``options`` Statement Grammar
@@ -2435,6 +2447,12 @@ for details on how to specify IP address lists.
    allows outgoing zone transfers to any host using the TLS transport
    over port 853.
 
+.. warning::
+
+   Please note that incoming TLS connections are currently
+   **not authenticated at the TLS level**.
+   Please use :ref:`tsig` to authenticate requestors.
+
 ``blackhole``
    This specifies a list of addresses which the server does not accept queries
    from or use to resolve a query. Queries from these addresses are not