From: Matthijs Mekking <matthijs@isc.org>
Date: Wed, 6 Oct 2021 14:15:36 +0000 (+0200)
Subject: Add CHANGES and release note for [GL #1316]
X-Git-Tag: v9.17.20~58^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0870d666dc5a426ceaa6f1e87c89ae1f9bcc984b;p=thirdparty%2Fbind9.git

Add CHANGES and release note for [GL #1316]
---

diff --git a/CHANGES b/CHANGES
index d91551c1b43..42f6bd2814f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5739.	[func]		Change default of 'dnssec-dnskey-kskonly' to 'yes'.
+			[GL #1316]
+
 5738.	[bug]		Enable idn2 UseSTD3ASCIIRules=true to implement
 			additional unicode validity checks. [GL #1610]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index c3847909d4f..3076250a501 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -78,6 +78,12 @@ Feature Changes
 
 .. _UseSTD3ASCIIRules: http://www.unicode.org/reports/tr46/#UseSTD3ASCIIRules
 
+- The default for ``dnssec-dnskey-kskonly`` is changed to ``yes``. This means
+  that DNSKEY, CDNSKEY, and CDS RRsets are now only signed with the KSK by
+  default. The additional signatures from the ZSK that are added if the option
+  is set to ``no`` add to the DNS response payload without offering added value.
+  :gl:`#1316`
+
 Bug Fixes
 ~~~~~~~~~