diff --git a/NEWS b/NEWS
index 3a8b9a06279035faba0a3d5edbf3aec9692b0231..59292e553c701a43a8381905f0c49eb4e689a34b 100644
--- a/NEWS
+++ b/NEWS
@@ -68,7 +68,7 @@ Features:
  - Synthetic IPv4/IPv6 reverse/forward records (optional module)
  - dnstap support in both utilities & server (optional module)
  - NOTIFY message support and new TSIG section in kdig
- - Multi-master support
+ - Zone transfer master failover
 
 Improvements:
 -------------
diff --git a/doc/configuration.rst b/doc/configuration.rst
index 2ca2bd9cce9e6bc2e733d29f63663d9ae3aa32c3..269df00e4401e5f002c0ee4485bb3d855cd68dc5 100644
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -79,6 +79,12 @@ AXFR::
       }
     }
 
+Note that the ``xfr-in`` option accepts a list of multiple remotes.
+The first remote in the list is used as a primary master, and the rest is used
+for failover should the connection with the primary master fail.
+The list is rotated in this case, and a new primary is elected.
+The preference list is reset on the configuration reload.
+
 You can also use TSIG for access control. For this, you need to configure a TSIG key
 and assign it to a remote.  Supported algorithms for TSIG key are:
 | ``hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, hmac-sha512``