changes suggested by mind04

diff --git a/docs/markdown/authoritative/backend-generic-sql.md b/docs/markdown/authoritative/backend-generic-sql.md
index b2454e26ee555321b8bcc2d6621a6aa19d4f7161..ed401d46c95e9f4576b00684b5d474c460eb99a4 100644 (file)
--- a/docs/markdown/authoritative/backend-generic-sql.md
+++ b/docs/markdown/authoritative/backend-generic-sql.md
@@ -110,7 +110,7 @@ To enable DNSSEC processing, the `backend-dnssec` option must be set to 'yes'.
 
 ## Rules for filling out DNSSEC fields
 Two additional fields in the 'records' table are important: 'auth' and 'ordername'.
-These fields are set correctly on a zone transfer, and also by running
+These fields are set correctly on an incoming zone transfer, and also by running
 `pdnsutil rectify-zone`.
 
 The 'auth' field should be set to '1' for data for which the zone itself is
@@ -137,7 +137,7 @@ encoded representation of the salted & iterated hash of the full record name.
 
 In addition, PowerDNS fully supports empty non-terminals. If you have a zone
 example.com, and a host a.b.c.example.com in it, rectify-zone (and the AXFR
-code) will insert b.c.example.com and c.example.com in the records table
+client code) will insert b.c.example.com and c.example.com in the records table
 with type NULL (SQL NULL, not 'NULL'). Having these entries provides several benefits.
 We no longer reply NXDOMAIN for these shorter names (this was an RFC violation
 but not one that caused trouble). But more importantly, to do NSEC3 correctly,

diff --git a/docs/markdown/authoritative/dnssec.md b/docs/markdown/authoritative/dnssec.md
index 10b5e74531e177e56d3755f60424101994393053..65361377e63025677ecc55cedeab2f0388f2b365 100644 (file)
--- a/docs/markdown/authoritative/dnssec.md
+++ b/docs/markdown/authoritative/dnssec.md
@@ -218,10 +218,16 @@ In this way, if keying material is available for an unsigned zone that is
 retrieved from a master server, this keying material will be used when serving
 data from this zone.
 
-As part of the zone transfer, the equivalent of `pdnsutil rectify-zone` is run
-to make sure that all DNSSEC-related fields are set correctly.
+As part of the zone retrieval, the equivalent of `pdnsutil rectify-zone` is run
+to make sure that all DNSSEC-related fields are set correctly in the backend.
 
-Signatures and Hashing is similar as described [above](#online-signing)
+## Signed AXFR
+An outgoing zone transfer from a signing master contains all information
+required for the receiving party to rectify the zone without knowing the keys,
+such as signed NSEC3 records for empty non-terminals. The zone is not required
+to be rectified on the master.
+
+Signatures and Hashing is similar as described [above](#online-signing).
 
 ## BIND-mode operation
 Starting with PowerDNS 3.1, the bindbackend can manage keys in an SQLite3 database