In section 5.5 "ptr"
"This mechanism matches if the <target-name> is an ancestor of a
validated hostname, or if the <target-name> and a validated hostname
are the same. For example: "mail.example.com" is within the domain
"example.com", but "mail.bad-example.com" is not. If a validated
hostname is the <target-name>, a match results."
Maybe a better (or additional) example would be:
For example: "mail.employees.example.com" is within the domain
"employees.example.com", but "mail.example.com" is not. If a validated
hostname is the <target-name>, a match results."
Thanks,
Guy