> I have one more question - how can I block every update for every zone
> in options section using update-policy?
Are you actually *reading* the documentation: the ARM actually defines
`allow-update':
"Specifies which hosts are allowed to submit Dynamic DNS updates
for master zones. The default is to deny updates from all
hosts."
-JP