Add CHANGES and release note for [GL #1316]

diff --git a/CHANGES b/CHANGES
index d91551c1b43a27f5d461ec94d908b6ebc589f693..42f6bd2814fef9f4964620c9e0ba0dd69a5d0277 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5739.  [func]          Change default of 'dnssec-dnskey-kskonly' to 'yes'.
+                       [GL #1316]
+
 5738.  [bug]           Enable idn2 UseSTD3ASCIIRules=true to implement
                        additional unicode validity checks. [GL #1610]
 

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index c3847909d4f255ed3ff540f53af8d135ac84a1dc..3076250a501b955ce6a4fb7d73bb1987141b2447 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -78,6 +78,12 @@ Feature Changes
 
 .. _UseSTD3ASCIIRules: http://www.unicode.org/reports/tr46/#UseSTD3ASCIIRules
 
+- The default for ``dnssec-dnskey-kskonly`` is changed to ``yes``. This means
+  that DNSKEY, CDNSKEY, and CDS RRsets are now only signed with the KSK by
+  default. The additional signatures from the ZSK that are added if the option
+  is set to ``no`` add to the DNS response payload without offering added value.
+  :gl:`#1316`
+
 Bug Fixes
 ~~~~~~~~~