Add CHANGES and release note for removed feature

Also mention that 'dnssec-secure-to-insecure' is obsoleted.

diff --git a/CHANGES b/CHANGES
index c39458f765e5e7fd08e8b638acf8adcfa14b19dd..59ed14a3f3f2ce09f2970bddcb35f15767becf0f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6023.  [func]          Remove dynamic update DNSSEC management feature.
+                       [GL #3686]
+
 6022.  [performance]   The decompression implementation in dns_name_fromwire()
                        is now smaller and faster. [GL #3655]
 

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 1dedc1b903d22ca9832bc51f3e1b129a2284b0db..8834c61db58c4491928475f3a6ac8e9ff3bfe11a 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -25,7 +25,10 @@ New Features
 Removed Features
 ~~~~~~~~~~~~~~~~
 
-- None.
+- Dynamic updates that add and remove DNSKEY and NSEC3PARAM records no
+  longer trigger key rollovers and denial of existence operations. This
+  also means that the option :any:`dnssec-secure-to-insecure` has been
+  obsoleted. :gl:`#3686`
 
 Feature Changes
 ~~~~~~~~~~~~~~~