A Settings section in docs/exposure.md: the counting model, a table of all 15 rate-limit settings from the BIND 9.20 ARM, and what was checked against real named (TCP never limited, NXDOMAIN falls back to responses-per-second and is counted per zone across names, all-per-second only drops, slipped answers are TC or BADCOOKIE depending on DNS cookies). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>