--- a/xml/dnsbl.in	Tue Dec 24 08:22:01 2013 -0800
+++ b/xml/dnsbl.in	Tue Dec 31 10:44:15 2013 -0800
@@ -200,6 +200,13 @@
                 domain.
             </para>
             <para>
+                This milter can also impose hourly and daily limits on the number of
+                different ip addresses used for SMTP AUTH connections. If a single
+                user is connecting from too many different ip addresses, we presume that
+                their authentication credentials have been discovered, and block their
+                outgoing mail.
+            </para>
+            <para>
                 Consider the case of a message from A to B passing thru this milter.  If
                 that message is not blocked, then we might eventually see a reply
                 message from B to A. If the filtering context for A includes an
@@ -334,10 +341,14 @@
                 that are unable to reply.
             </para>
             <para>
-                If the client has authenticated with sendmail, the rate limits are
+                If the client has authenticated with sendmail, the recipient rate limits
+                and connection ip address limits are
                 checked.  If the authenticated user has not exceeded the hourly or daily rate
                 limits, then the mail is accepted, the filtering contexts are not used,
-                the dns lists are not checked, and the body content is not scanned.  If
+                the dns lists are not checked, and the body content is not scanned.  These
+                rate limits can also be applied to unauthenticated connections, in which case
+                the envelope from value is used as the authentication id for lookup purposes.
+                If
                 the client has not authenticated with sendmail, we follow these steps
                 for each recipient.
             </para>
@@ -457,7 +468,7 @@
                 If the content uribl DNSBL is defined, and any of those host names are
                 on that DNSBL, and the host name is not on the &lt;configurable&gt;
                 ignore list, the mail is rejected. There are three lists that are suitable
-                here, uribl, surbl, and dbl.
+                here, URIBL, SURBL, and DBL.
             </para>
             <para>
                 If any non-whitelisted recipient has a filtering context with a non-zero
@@ -597,7 +608,8 @@
             </para>
             <para>
                 Add white/unknown to config for smtp authenticated connections. Currently
-                any authenticated connection is fully whitelisted. This would allow normal
+                any authenticated connection is fully whitelisted. The only spam control
+                on those connections is rate limiting. This feature would allow content based
                 spam controls to be applied even to authenticated connections. Add
                 context/authenticated_dnsbl_list and context/content/authenticated.
             </para>
@@ -613,8 +625,9 @@
                 mail software.
             </para>
             <para>
-                Add trusted_spf list of domains for which we trust their spf data. Mail
-                from their listed ip addresses from their domain will be whitelisted.
+                Add spf to the white/black/unknown values in env_from blocks. This
+                results in whitelisting that envelope from value as long as the connection
+                is made from an ip address listed in the domain spf txt record.
             </para>
         </refsect1>
 
@@ -787,8 +800,8 @@
 
     // hourly recipient rate limit by smtp auth client id, or unauthenticated mail from address
     // hourly unique ip addresses  by smtp auth client id, or unauthenticated mail from address
-    // default hourly rate limit is 30
-    // daily rate limits are 4 times the hourly limit
+    // default hourly recipient rate limit is 30
+    // daily recipient rate limits are 4 times the hourly limit
     // default hourly unique ip addresses is 5
     // daily unique ip addresses are 4 times the hourly limit
     rate_limit 30 4 5 4 { // default