diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 89da9499b..06d7ff0a3 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -728,7 +728,7 @@ This option only has effect when qname-minimisation is enabled. Default is off.
 .B aggressive\-nsec: \fI<yes or no>
 Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
 and other denials, using information from previous NXDOMAINs answers.
-Default is off.  It helps to reduce the query rate towards targets that get
+Default is no.  It helps to reduce the query rate towards targets that get
 a very high nonexistent name lookup rate.
 .TP
 .B private\-address: \fI<IP address or subnet>