Attempt to clarify use of TSIG key and ALLOW-DNSUPDATE-FROM

Clarify association between use of TSIG key and ALLOW-DNSUPDATE-FROM. Previous description sounded like AND

diff --git a/docs/dnsupdate.rst b/docs/dnsupdate.rst
index 6cbc953767a5228b2b1c14f19fb07c71d20fd633..b38f6c21e06c7fcf5f99b437d60712f0647871c9 100644 (file)
--- a/docs/dnsupdate.rst
+++ b/docs/dnsupdate.rst
@@ -135,9 +135,9 @@ An example of how to use a TSIG key with the :program:`nsupdate` command:
     !
 
 If a TSIG key is set for the domain, it is required to be used for the
-update. The TSIG is extra security on top of the
-``ALLOW-DNSUPDATE-FROM`` setting. If a TSIG key is set, the IP(-range)
-still needs to be allowed via ``ALLOW-DNSUPDATE-FROM``.
+update. The TSIG is an alternative means of securing updates, instead of using the
+``ALLOW-DNSUPDATE-FROM`` setting. If a TSIG key is set, and if ``ALLOW-DNSUPDATE-FROM`` is set,
+the IP(-range) of the updater still needs to be allowed via ``ALLOW-DNSUPDATE-FROM``. 
 
 FORWARD-DNSUPDATE
 ~~~~~~~~~~~~~~~~~