From: Aram Sargsyan <aram@isc.org>
Date: Thu, 14 Dec 2023 11:10:50 +0000 (+0000)
Subject: Add CHANGES and release notes for [GL #4373]
X-Git-Tag: v9.19.22~61^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fdb7e4e3f57752be3f535f4f50fe28573e073eb1;p=thirdparty%2Fbind9.git

Add CHANGES and release notes for [GL #4373]
---

diff --git a/CHANGES b/CHANGES
index b9e4a349c57..92fcf6ac275 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+6335.	[func]		The 'dnssec-validation yes' option now requires an
+			explicitly configured 'trust-anchors' statement (or
+			'managed-keys' or 'trusted-keys' statements, both
+			deprecated). [GL #4373]
+
 6334.	[doc]		Improve ARM parental-agents definition. [GL #4531]
 
 6333.	[bug]		Fix the DNS_GETDB_STALEFIRST flag, which was defined
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 9aa27c16aef..d45494484b8 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -41,7 +41,10 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
-- None.
+- The ``dnssec-validation yes`` option now requires an explicitly configured
+  :any:`trust-anchors` statement. If using manual trust anchors is not
+  operationally required, then please consider using ``dnssec-validation auto``
+  instead. :gl:`#4373`
 
 Bug Fixes
 ~~~~~~~~~