diff --git a/dns/bind/pkg-descr b/dns/bind/pkg-descr
index 545d1b6b6..4c59d1e86 100644
--- a/dns/bind/pkg-descr
+++ b/dns/bind/pkg-descr
@@ -13,6 +13,7 @@ Plugin Changelog
 * Reject built-in ACL names
 * Fix truncated checkboxes
 * Add button to delete selected items
+* Relax ACL name mask (allow underscores and hyphens)
 
 1.13
 
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Acl.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Acl.xml
index 51eb97422..6abff3a73 100644
--- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Acl.xml
+++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Acl.xml
@@ -12,8 +12,8 @@
                 <name type="TextField">
                     <default></default>
                     <Required>Y</Required>
-                    <mask>/^(?!any$|localhost$|localnets$|none$)[0-9a-zA-Z]{1,32}$/u</mask>
-                    <ValidationMessage>Should be a string between 1 and 32 characters. Allowed characters are 0-9a-zA-Z. Built-in ACL names must not be used: any, localhost, localnets, none.</ValidationMessage>
+                    <mask>/^(?!any$|localhost$|localnets$|none$)[0-9a-zA-Z_\-]{1,32}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 32 characters. Allowed characters are 0-9a-zA-Z_-. Built-in ACL names must not be used: any, localhost, localnets, none.</ValidationMessage>
                 </name>
                 <networks type="NetworkField">
                     <default></default>