+.section "Handling multiple DNS records from a DNS list" "SECThanmuldnsrec"
+A DNS lookup for a &%dnslists%& condition may return more than one DNS record,
+thereby providing more than one IP address. When an item in a &%dnslists%& list
+is followed by &`=`& or &`&&`& and a list of IP addresses, in order to restrict
+the match to specific results from the DNS lookup, there are two ways in which
+the checking can be handled. For example, consider the condition:
+.code
+dnslists = a.b.c=127.0.0.1
+.endd
+What happens if the DNS lookup for the incoming IP address yields both
+127.0.0.1 and 127.0.0.2 by means of two separate DNS records? Is the
+condition true because at least one given value was found, or is it false
+because at least one of the found values was not listed? And how does this
+affect negated conditions? Both possibilities are provided for with the help of
+additional separators &`==`& and &`=&&`&.
+
+.ilist
+If &`=`& or &`&&`& is used, the condition is true if any one of the looked up
+IP addresses matches one of the listed addresses. For the example above, the
+condition is true because 127.0.0.1 matches.
+.next
+If &`==`& or &`=&&`& is used, the condition is true only if every one of the
+looked up IP addresses matches one of the listed addresses. If the condition is
+changed to:
+.code
+dnslists = a.b.c==127.0.0.1
+.endd
+and the DNS lookup yields both 127.0.0.1 and 127.0.0.2, the condition is
+false because 127.0.0.2 is not listed. You would need to have:
+.code
+dnslists = a.b.c==127.0.0.1,127.0.0.2
+.endd
+for the condition to be true.
+.endlist
+
+When &`!`& is used to negate IP address matching, it inverts the result, giving
+the precise opposite of the behaviour above. Thus:
+.ilist
+If &`!=`& or &`!&&`& is used, the condition is true if none of the looked up IP
+addresses matches one of the listed addresses. Consider:
+.code
+dnslists = a.b.c!&0.0.0.1
+.endd
+If the DNS lookup yields both 127.0.0.1 and 127.0.0.2, the condition is
+false because 127.0.0.1 matches.
+.next
+If &`!==`& or &`!=&&`& is used, the condition is true there is at least one
+looked up IP address that does not match. Consider:
+.code
+dnslists = a.b.c!=&0.0.0.1
+.endd
+If the DNS lookup yields both 127.0.0.1 and 127.0.0.2, the condition is
+true, because 127.0.0.2 does not match. You would need to have:
+.code
+dnslists = a.b.c!=&0.0.0.1,0.0.0.2
+.endd
+for the condition to be false.
+.endlist
+When the DNS lookup yields only a single IP address, there is no difference
+between &`=`& and &`==`& and between &`&&`& and &`=&&`&.
+.wen
+
+
+
+