half broken

deploy/zones/local.rpz.zone.example

@@ -1,23 +1,31 @@
 ; Example RPZ-style policy zone.
 ;
 ; Drop everything from these services, for this host and its subdomains.
+;
+; As in local.example.zone, every owner name is fully qualified. A policy zone
+; is read with the origin taken from the file name (internal/blocklist prepends
+; `$ORIGIN` per file), so a relative `*.doubleclick.net` in a file called
+; local.rpz.zone.example becomes *.doubleclick.net.local. — a rule that blocks
+; nothing you care about. Absolute owner names are the only spelling that is
+; independent of what the file is called; TestExampleRPZZoneBlocksWhatItSays
+; in internal/blocklist pins that the example blocks what its comments claim.
 $TTL 60
-@ SOA localhost. hostmaster.localhost. 1 3600 600 604800 60
-@ NS  localhost.
+localhost.        SOA     localhost. hostmaster.localhost. 1 3600 600 604800 60
+localhost.        NS      localhost.
 
 ; *.doubleclick.net CNAME .   -> NXDOMAIN
-*.doubleclick.net       CNAME .
-*.ads.example.com       CNAME .
-*.tracker.example.net   CNAME .
-analytics.example.org   CNAME .
+*.doubleclick.net.        CNAME .
+*.ads.example.com.        CNAME .
+*.tracker.example.net.    CNAME .
+analytics.example.org.    CNAME .
 
 ; CNAME rpz-drop. -> answer with silence
-*.noisy-cdn.example     CNAME rpz-drop.
+*.noisy-cdn.example.      CNAME rpz-drop.
 
 ; CNAME rpz-passthru. -> ignore blocklists for this name
-metrics.internal.       CNAME rpz-passthru.
+metrics.internal.         CNAME rpz-passthru.
 
 ; A/AAAA records in a policy zone are returned verbatim, which is the cleanest
 ; way to point a blocked name at a local landing page.
-blocked.example         A     192.0.2.10
-                       AAAA  2001:db8::10
+blocked.example.          A     192.0.2.10
+                          AAAA  2001:db8::10