diff --git a/doc/man/knot.conf.5in b/doc/man/knot.conf.5in
index e71dc1ad987b056e9f7b171d70737a061cc6b215..e0bc921a6ab21da3480e1d014cb41983b3e8ec51 100644
--- a/doc/man/knot.conf.5in
+++ b/doc/man/knot.conf.5in
@@ -692,6 +692,7 @@ zone:
     zonefile\-sync: TIME
     ixfr\-from\-differences: BOOL
     max\-journal\-size: SIZE
+    max\-zone\-size : SIZE
     dnssec\-signing: BOOL
     dnssec\-policy: STR
     kasp\-db: STR
@@ -856,6 +857,17 @@ This option has no effect with enabled
 Maximum size of the zone journal file.
 .sp
 \fIDefault:\fP 2^64
+.SS max\-zone\-size
+.sp
+Maximum size of the zone. The size is measured as size of the zone records
+in wire format without compression. The limit is enforced for incoming zone
+transfers and dynamic updates.
+.sp
+For incremental transfers (IXFR), the effective limit for the total size of
+the records in the transfer is twice the configured value. However the final
+size of the zone must satisfy the configured value.
+.sp
+\fIDefault:\fP 2^64
 .SS dnssec\-signing
 .sp
 If enabled, automatic DNSSEC signing for the zone is turned on.