DNS Resolver Advanced Setting

[vc6SfV8]

I am attempting to apply a access control setting to allow the DNS resolver to resolve a specific non-local domain for a specific host that is otherwise restricted to local resolution only.

I've researched this, and believe I need the tag access-control-tag-data.

I added the setting below to Custom options in the DNS Resolver.

server:access-control-tag-data: 10.13.141.6/32 allow "domain.com"

The change is accepted, but the resolver then fails to start with the following in the logs.

Jun 2 11:30:48	unbound	43744:0	fatal error: Could not setup access control list
Jun 2 11:30:48	unbound	43744:0	error: cannot parse tag (define-tag it): 10.13.141.6/32 allow

I might be having some confusion with tags, does anyone know how to do what I am attempting to accomplish?