Documentation nits

See the individual commit messages.

modules/policy/README.rst

@@ -36,12 +36,21 @@ A *filter* selects which queries will be affected by specified Actions_. There a
 
    Applies the action if query name suffix matches one of suffixes in the table (useful for "is domain in zone" rules).
 
-.. note:: For speed this filter requires domain names in DNS wire format, not textual representation, so each label in the name must be prefixed with its length. Always use convenience function :func:`policy.todnames` for automatic conversion from strings! For example:
-
    .. code-block:: lua
 
       policy.add(policy.suffix(policy.DENY, policy.todnames({'example.com', 'example.net'})))
 
+.. note:: For speed this filter requires domain names in DNS wire format, not textual representation, so each label in the name must be prefixed with its length. Always use convenience function :func:`policy.todnames` for automatic conversion from strings! For example:
+
+.. _IDN:
+
+.. note:: Non-ASCII is not supported.
+
+   Knot Resolver does not provide any convenience support for IDN.
+   Therefore everywhere (all configuration, logs, RPZ files) you need to deal with the
+   `xn\-\- forms <https://en.wikipedia.org/wiki/Internationalized_domain_name#Example_of_IDNA_encoding>`_
+   of domain name labels, instead of directly using unicode characters.
+
 .. function:: domains(action, domain_table)
 
    Like :func:`policy.suffix` match, but the queried name must match exactly, not just its suffix.
@@ -691,6 +700,8 @@ Response policy zones
 
         log_groups({'policy'})
 
+     See also :ref:`non-ASCII support note <IDN>`.
+
 
 .. function:: rpz(action, path, [watch = true])