From: Ondřej Surý <ondrej@isc.org>
Date: Mon, 15 Apr 2024 10:44:41 +0000 (+0200)
Subject: Add CHANGES and release notes for [GL #4586]
X-Git-Tag: v9.19.24~25^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5d4233c2c2f79b7d6bdaa5044b6231f73e345298;p=thirdparty%2Fbind9.git

Add CHANGES and release notes for [GL #4586]
---

diff --git a/CHANGES b/CHANGES
index 67ad1f22652..58e3475bda8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6374.	[func]		Don't count expired / future RRSIGs in verification
+			failure quota. [GL #4586]
+
 6373.	[func]		Offload the isc_http response processing to worker
 			thread. [GL #4680]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index cfbcc05c8d1..8e3ac9e8b41 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -36,6 +36,10 @@ Feature Changes
 - Querying the statistics channel no longer blocks the DNS communication
   on the networking event loop. :gl:`#4680`
 
+- DNSSEC signatures that are not valid because the current time falls outside
+  the signature inception and expiration dates no longer count towards maximum
+  validation and maximum validation failures limits. :gl:`#4586`
+
 Bug Fixes
 ~~~~~~~~~