diff --git a/doc/Changelog b/doc/Changelog
index 4a14c6060..cafe8fe1c 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+11 February 2019: Wouter
+	- Note default for module-config in man page.
+
 7 February 2019: Wouter
 	- Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2.
 	- Fix that qname minimisation does not skip a label when missing
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 88340b4a1..9cbcda406 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -930,6 +930,8 @@ Setting this to "iterator" will result in a non\-validating server.
 Setting this to "validator iterator" will turn on DNSSEC validation.
 The ordering of the modules is important.
 You must also set trust\-anchors for validation to be useful.
+The default is "validator iterator".  When the server is built with
+EDNS client subnet support the default is "subnetcache validator iterator".
 .TP
 .B trust\-anchor\-file: \fI<filename>
 File with trusted keys for validation. Both DS and DNSKEY entries can appear