Document potential issue with R53 provider. See
@@ -51,3 +51,23 @@ If a domain does not exist in your Route53 account, DNSControl
will *not* automatically add it. You can do that either manually
via the control panel, or via the command `dnscontrol create-domains`
command.
+
+## Caveats
+
+This code may not function properly if a domain has R53 as a Registrar
+but not as a DnsProvider. The situation is described in
+[PR#155](https://github.com/StackExchange/dnscontrol/pull/155).
+
+In this situation you will see a message like:
+
+```
+----- Registrar: r53
+Error getting corrections: AccessDeniedException: User: arn:aws:iam::868399730840:user/dnscontrol is not authorized to perform: route53domains:GetDomainDetail
+ status code: 400, request id: 48b534a1-7902-11e7-afa6-a3fffd2ce139
+Done. 1 corrections.
+```
+
+If this happens to you, we'd appreciate it if you could helps us
+fix the code. In the meanwhile, you can give the account additional
+IAM permissions so that it can do DNS-related actions, or simply
+use `NewRegistrar(..., 'NONE')` for now.
