> I have one more question - how can I block every update for every zone > in options section using update-policy? Are you actually *reading* the documentation: the ARM actually defines `allow-update': "Specifies which hosts are allowed to submit Dynamic DNS updates for master zones. The default is to deny updates from all hosts." -JP