dsync replication

[Matt Bryant]

We have a setup with ldap and sql passdbs and sql userdb, from my
understanding of the documentation dsync repliction picks up the users
to replicate via the iterate query. This query returns 646 users in sql
(not everyone gets replicated) but when i run a doveadm replicator status

Total number of known users   92236

seriously that kinda lot more than 646

Does iterate_query belong in user_db or passdb? Is it the fact I have
ldap and sql passdb and its picking up dome default ldap query as well
the specified sql iterate query ?

rgds

Matt