[master] add nsip-wait-recurse release note

diff --git a/CHANGES b/CHANGES
index c02c038da4001766d3ab3a3f3dcbcda614ccef9d..8cff8928bf7fb2a03ca30ccdebcaf9fba0b93e1c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -12,7 +12,7 @@
 
 4356.  [func]          Add the ability to specify whether to wait for
                        nameserver addresses to be looked up or not to
-                       rpz with a new modifying directive 'nsip-wait-recurse'.
+                       RPZ with a new modifying directive 'nsip-wait-recurse'.
                        [RT #35009]
 
 4355.  [func]          "pkcs11-list" now displays the extractability

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 3fb953275a11fce1a62097be71a432f366ced797..0f27999f86a4cd5a393a9b4703197168469d6c26 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -649,6 +649,20 @@
          on Linux is now supported.
        </para>
       </listitem>
+      <listitem>
+       <para>
+         A new <option>nsip-wait-recurse</option> directive has been
+         added to RPZ, specifying whether to look up unknown name server
+         IP addresses and wait for a response before applying RPZ-NSIP rules.
+         The default is <userinput>yes</userinput>. If set to
+         <userinput>no</userinput>, <command>named</command> will only
+         apply RPZ-NSIP rules to servers whose addresses are already cached.
+         The addresses will be looked up in the background so the rule can
+         be applied on subsequent queries. This improves performance when
+         the cache is cold, at the cost of temporary imprecision in applying
+         policy directives. [RT #35009]
+       </para>
+      </listitem>
       <listitem>
        <para>
          Within the <option>response-policy</option> option, it is now