From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Oct 2021 04:23:43 +0000 (+1100)
Subject: Add CHANGES and release note for [GL #1265]
X-Git-Tag: v9.17.21~5^2~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=12c64d55f2471eab5e5663d9359b4f24592bfa98;p=thirdparty%2Fbind9.git

Add CHANGES and release note for [GL #1265]
---

diff --git a/CHANGES b/CHANGES
index 8fcdbc995c9..29fc31e5868 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5774.	[func]		Restore NSEC Aggressive Cache ("synth-from-dnssec")
+			as active by default. It is limited to NSEC only
+			and by default ignores NSEC records with next name
+			in form \000.domain. [GL #1265]
+
 5773.	[func]		Change the message when accepting TCP connection has
 			failed to say "Accepting TCP connection failed" and
 			change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index e539c51c9bf..5bca71daae6 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -58,6 +58,11 @@ Feature Changes
   events: ``socket is not connected``, ``quota reached``, and ``soft
   quota reached``. :gl:`#2700`
 
+- Restore NSEC Aggressive Cache (``synth-from-dnssec``) as active by default.
+  The implementation was optimized for better efficiency, and also tuned
+  to ignore certain types of broken NSEC records.  This feature currently
+  supports answer synthtesis only for zones using NSEC.  :gl:`#1265`
+
 Bug Fixes
 ~~~~~~~~~