From: Evan Hunt <each@isc.org>
Date: Thu, 5 May 2016 16:33:28 +0000 (-0700)
Subject: [master] add nsip-wait-recurse release note
X-Git-Tag: v9.11.0a2~43
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=370c6e0ac1ad6330e5ded66e5636c5c93d2ce3ff;p=thirdparty%2Fbind9.git

[master] add nsip-wait-recurse release note
---

diff --git a/CHANGES b/CHANGES
index c02c038da40..8cff8928bf7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -12,7 +12,7 @@
 
 4356.	[func]		Add the ability to specify whether to wait for
 			nameserver addresses to be looked up or not to
-			rpz with a new modifying directive 'nsip-wait-recurse'.
+			RPZ with a new modifying directive 'nsip-wait-recurse'.
 			[RT #35009]
 
 4355.	[func]		"pkcs11-list" now displays the extractability
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 3fb953275a1..0f27999f86a 100644
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -649,6 +649,20 @@
 	  on Linux is now supported.
 	</para>
       </listitem>
+      <listitem>
+	<para>
+	  A new <option>nsip-wait-recurse</option> directive has been
+	  added to RPZ, specifying whether to look up unknown name server
+	  IP addresses and wait for a response before applying RPZ-NSIP rules.
+	  The default is <userinput>yes</userinput>. If set to
+	  <userinput>no</userinput>, <command>named</command> will only
+	  apply RPZ-NSIP rules to servers whose addresses are already cached.
+	  The addresses will be looked up in the background so the rule can
+	  be applied on subsequent queries. This improves performance when
+	  the cache is cold, at the cost of temporary imprecision in applying
+	  policy directives. [RT #35009]
+	</para>
+      </listitem>
       <listitem>
 	<para>
 	  Within the <option>response-policy</option> option, it is now