Here is my interpretation of the manual: no. 2 applies if and only if "access-control" entries are absent. No. 1 applies if and only if (one or more) "access-control" entries are present. I am new to unbound. That is why, you may wish to reconfirm the above interpretation with other users. Cheers, Sen Dion