filling 'ordename' and 'auth'

diff --git a/pdns/docs/pdns.xml b/pdns/docs/pdns.xml
index 10b02b8a9db4b5d8c79d1bbf28e0d76b1f26bdae..f081b237c6e8a67138262134556369aeb3296e95 100755 (executable)
--- a/pdns/docs/pdns.xml
+++ b/pdns/docs/pdns.xml
@@ -12979,10 +12979,10 @@ $ pdnssec rectify-zone powerdnssec.org
     present for this purpose. Do note that the DS record for a secure delegation should be authoritative!
   </para>
   <para>
-    The 'ordername' field needs to be filled out depending on the NSEC/NSEC3 mode. When running in NSEC3 'Narrow' mode,
-    the ordername field is ignored and best left empty. In NSEC mode, the ordername field should be NULL for any glue but filled in
-    for delegation NS records and all authoritative records. In NSEC3 opt-out mode (the only NSEC3 mode PowerDNS currently
-    supports), any non-authoritative records (as described for the 'auth' field) should have ordername set to NULL.
+    The 'ordername' field needs to be filled out depending on the NSEC/NSEC3 mode. When running in NSEC3 'Narrow' mode, the
+    ordername field is ignored and best left empty. In NSEC/NSEC3 mode, the ordername field should be NULL for any glue but filled in
+    for all delegation NS records and all authoritative records. In NSEC3 opt-out mode, ordername is NULL for any glue and insecure
+    delegation NS records, but filled in for secure delegation NS records and all authoritative records.
   </para>
   <para>
     In 'NSEC' mode, it should contain the <emphasis>relative</emphasis> part of a domain name, in reverse order, with dots replaced