From: Petr Špaček <pspacek@isc.org>
Date: Wed, 5 Oct 2022 13:21:36 +0000 (+0200)
Subject: Add Known Issue about config incompatibility
X-Git-Tag: v9.19.6~3^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5589d0a49c722c13f78fccdd955c377b9c32c13e;p=thirdparty%2Fbind9.git

Add Known Issue about config incompatibility
---

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0152d9f2087..e6c5a02c934 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -20,7 +20,17 @@ Security Fixes
 Known Issues
 ~~~~~~~~~~~~
 
-- None.
+- Upgrading from BIND 9.16.32, 9.18.6, or older, may require a manual
+  configuration change. The following configurations are affected:
+
+  - :any:`type primary` zones configured with :any:`dnssec-policy` but without
+    either :any:`allow-update` or :any:`update-policy`
+  - :any:`type secondary` zones configured with :any:`dnssec-policy`
+
+  In these cases please add :namedconf:ref:`inline-signing yes;
+  <inline-signing>` to individual zone configuration(s). Without applying this
+  change :iscman:`named` will fail to start. For more details see
+  https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
 
 New Features
 ~~~~~~~~~~~~