Update NEWS

diff --git a/NEWS b/NEWS
index 1c75e33505dac7ad9909f964da9f1d0465a47c80..6326889206d63a98efe73d95dad60d65fd63538f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,11 @@
 Knot Resolver 1.2.4-dev (2017-03-XX)
 ================================
 
+Security
+--------
+- If the same answer is validated three or more time, the daemon could
+  return AD flag for insecure answer.
+
 Improvements
 ------------
 - modules/policy: allow QTRACE policy to be chained with other policies
@@ -13,10 +18,13 @@ Improvements
 Bugfixes
 --------
 - layer/iterate: some improvements in cname chain unrolling
-- layer/validate: fix duplicate records in AUTHORITY section in case of WC expansion proof
+- layer/validate: fix duplicate records in AUTHORITY section in case
+  of WC expansion proof
 - lua: do *not* truncate cache size to unsigned
 - forwarding mode: correctly forward +cd flag
 - fix a potential memory leak
+- don't treat answers that contain DS non-existance proof as insecure
+- don't store NSEC3 and their signatures in the cache
 
 
 Knot Resolver 1.2.3 (2017-02-23)