diff --git a/doc/man/knot.conf.5in b/doc/man/knot.conf.5in
index 0442299eb16cd584e28f53efd18210d007893247..3c4e860ead8b68f5546f67c3543c925ebdea1989 100644
--- a/doc/man/knot.conf.5in
+++ b/doc/man/knot.conf.5in
@@ -1941,6 +1941,9 @@ prevented from loading.
 .sp
 If enabled, extra checks are used. These checks don\(aqt prevent the zone from loading.
 .sp
+The mandatory checks are applied to zone files, zone transfers, and updates via
+control interface. The extra checks are applied to zone files only!
+.sp
 Mandatory checks:
 .INDENT 0.0
 .IP \(bu 2
@@ -1950,7 +1953,7 @@ Missing SOA record at the zone apex (\fI\%RFC 1034\fP)
 Mandatory checks affected by the soft mode:
 .INDENT 0.0
 .IP \(bu 2
-An extra record exists together with a CNAME record except for RRSIG and DS (\fI\%RFC 1034\fP)
+An extra record exists together with a CNAME record except for RRSIG and NSEC (\fI\%RFC 1034\fP)
 .IP \(bu 2
 Multiple CNAME records with the same owner exist (\fI\%RFC 1034\fP)
 .IP \(bu 2
diff --git a/doc/reference.rst b/doc/reference.rst
index 1d8dd758e7d442d7971f96a548cda7ac9d87ee46..c797d6886eea8f87f3524edec9102338cd88b862 100644
--- a/doc/reference.rst
+++ b/doc/reference.rst
@@ -2121,13 +2121,16 @@ prevented from loading.
 
 If enabled, extra checks are used. These checks don't prevent the zone from loading.
 
+The mandatory checks are applied to zone files, zone transfers, and updates via
+control interface. The extra checks are applied to zone files only!
+
 Mandatory checks:
 
 - Missing SOA record at the zone apex (:rfc:`1034`)
 
 Mandatory checks affected by the soft mode:
 
-- An extra record exists together with a CNAME record except for RRSIG and DS (:rfc:`1034`)
+- An extra record exists together with a CNAME record except for RRSIG and NSEC (:rfc:`1034`)
 - Multiple CNAME records with the same owner exist (:rfc:`1034`)
 - DNAME record having a record under it (:rfc:`6672`)
 - Multiple DNAME records with the same owner exist (:rfc:`6672`)