CHANGES, release notes, README

diff --git a/CHANGES b/CHANGES
index 6956376258e7aab0477597913873560e667f6607..f0325241231ee37ce45d0bdbfd04d65245bfa647 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5010.  [func]          New "validate-except" option specifies a list of
+                       domains beneath which DNSSEC validation should not
+                       be performed. [GL #237]
+
 5009.  [bug]           Upon an OpenSSL failure, the first error in the OpenSSL
                        error queue was not logged. [GL #476]
 

diff --git a/README b/README
index c9f542126443bb4bfeaf1f3c4609bfa60f40d8e2..ba5f29d9f186a6d54b9a5435647fd9c2fa2adb9a 100644 (file)
--- a/README
+++ b/README
@@ -114,6 +114,9 @@ of changes from BIND 9.12 and earlier releases. New features include:
     subject to DNSSEC validation and are not treated as authoritative data
     when answering. This makes it easier to configure a local copy of the
     root zone as described in RFC 7706.
+  * QNAME minimization is now supported
+  * The "validate-except" option allows configuration of domains below
+    which DNSSEC validation should not be performed.
 
 In addition, cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which

diff --git a/README.md b/README.md
index b283ff98c8f1df6b541fed0dfc72d86cee1718b6..e06941f40d6b33b1926752ac127d4e4945375a53 100644 (file)
--- a/README.md
+++ b/README.md
@@ -131,6 +131,9 @@ include:
   DNSSEC validation and are not treated as authoritative data when
   answering. This makes it easier to configure a local copy of the root
   zone as described in RFC 7706.
+* QNAME minimization is now supported
+* The "validate-except" option allows configuration of domains below which
+  DNSSEC validation should not be performed.
 
 In addition, cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 8a1f647af5662c673a77f4baf26c19d3d63397eb..de2760cbe5ca3f20770ec28a02036c1fa8b7d6ff 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -143,6 +143,14 @@
          loss of security.
        </para>
       </listitem>
+      <listitem>
+       <para>
+         The <command>validate-except</command> option specifies a list of
+         domains beneath which DNSSEC validation should not be performed,
+         regardless of whether a trust anchor has been configured above
+         them. [GL #237]
+       </para>
+      </listitem>
     </itemizedlist>
   </section>