diff --git a/docs/rolereference.rst b/docs/rolereference.rst
index a77cdc1a8e526e3c29f82e4e36a5d6a44322db85..a2a4a9469e9a3a2e43c9f24b4c53e42c9548de61 100644
--- a/docs/rolereference.rst
+++ b/docs/rolereference.rst
@@ -1315,8 +1315,15 @@ The role implements the following:
 * Purges Exim4 configuration (just in case).
 * Sets-up aliases for the local recipients.
 * Installs SWAKS (utility for testing SMTP servers).
-* Configures firewall to accept SMTP connections from SMTP relay (if one has
-  been configured). This allows for delivery of bounced e-mails.
+* Configures firewall to accept SMTP connections from SMTP relay (if
+  one has been configured). This allows for delivery of bounced
+  e-mails.
+
+  .. note::
+     Firewall rules are based on IPv4 and IPv6 addresses resolved via
+     managed server at time of deployment. If the SMTP relay changes
+     its IP addresess, this role needs to be reapplied against the
+     managed machines.
 
 Postfix is configured as follows: