From: Michał Kępień <michal@isc.org>
Date: Tue, 7 Sep 2021 07:41:09 +0000 (+0200)
Subject: Tweak and reword release notes
X-Git-Tag: v9.16.21~1^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d2c446bc4dd2e6d877e1d8a0bc92c34319785388;p=thirdparty%2Fbind9.git

Tweak and reword release notes
---

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 60791ecf75b..fd44b8449e4 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -24,7 +24,9 @@ Known Issues
 New Features
 ~~~~~~~~~~~~
 
-- Add support for HTTPS and SVCB record types. :gl:`#1132`
+- Support for HTTPS and SVCB record types has been added. (This does not
+  include ADDITIONAL section processing for these record types, only
+  basic support for RR type parsing and printing.) :gl:`#1132`
 
 Removed Features
 ~~~~~~~~~~~~~~~~
@@ -34,24 +36,29 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
-- ``dnssec-signzone`` is now able to retain signatures from inactive
-  predecessor keys without introducing additional signatures from the successor
-  key. This allows for a gradual replacement of RRSIGs as they reach expiry.
-  :gl:`#1551`
+- When ``dnssec-signzone`` signs a zone using a successor key whose
+  predecessor is still published, it now only refreshes signatures for
+  RRsets which have an invalid signature, an expired signature, or a
+  signature which expires within the provided cycle interval. This
+  allows ``dnssec-signzone`` to gradually replace signatures in a zone
+  whose ZSK is being rolled over (similarly to what ``auto-dnssec
+  maintain;`` does). :gl:`#1551`
 
 Bug Fixes
 ~~~~~~~~~
 
-- When following QNAME minimization, BIND could use a stale zonecut from cache 
-  to resolve the query, resulting in a non-minimized query. This has been
-  fixed :gl:`#2665`
+- Stale data in the cache could cause ``named`` to send non-minimized
+  queries despite QNAME minimization being enabled. This has been fixed.
+  :gl:`#2665`
 
-- Migrate a single key to CSK when reconfiguring a zone to make use of
-  'dnssec-policy' :gl:`#2857`
+- When a DNSSEC-signed zone which only has a single signing key
+  available is migrated to ``dnssec-policy``, that key is now treated as
+  a Combined Signing Key (CSK). :gl:`#2857`
 
 - A recent change to the internal memory structure of zone databases
-  inadvertently neglected to update the MAPAPI value for ``map``-format
-  zone files. This caused ``named`` to attempt to load files into memory
-  that were no longer compatible, triggering an assertion failure on
-  startup. The MAPAPI value has now been updated, so ``named`` will
-  reject outdated files when encountering them. :gl:`#2872`
+  inadvertently neglected to update the MAPAPI value for zone files in
+  ``map`` format. This caused version 9.16.20 of ``named`` to attempt to
+  load files into memory that were no longer compatible, triggering an
+  assertion failure on startup. The MAPAPI value has now been updated,
+  so ``named`` rejects outdated files when encountering them.
+  :gl:`#2872`