This means that anything not explicitly allowed will be denied. The client list lists only localhost . Since the incoming connection is not from localhost , tcpd proceeds to the next line. The daemon list of the second line lists telnetd . This matches the incoming connection, so once again tcpd proceeds to the client list.
All criteria having been satisfied, tcpd passes off the connection to the real telnetd .
This time there is no domain name match. There is a similar IP address listed, but it is not an exact match. No matches are found in the client list of the third line, so tcpd proceeds to the fourth line. The wildcard ALL matches all daemons, so we proceed to another ALL wildcard that matches all clients. That's very complicated, but don't worry.