Add Known Issue about config incompatibility

(cherry picked from commit 5589d0a49c722c13f78fccdd955c377b9c32c13e)

Adapted for v9_16 branch: Removed hyperlinks, removed note about 9.18.

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 38e8061e1eb9dcc2ceb0e1476836ed40932e794c..6850318c4a6adb76fc63b0d34500f8d3e3e7bd03 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -20,7 +20,17 @@ Security Fixes
 Known Issues
 ~~~~~~~~~~~~
 
-- None.
+- Upgrading from BIND 9.16.32 or older may require a manual
+  configuration change. The following configurations are affected:
+
+  - ``type primary`` zones configured with ``dnssec-policy`` but without
+    either ``allow-update`` or ``update-policy``
+  - ``type secondary`` zones configured with ``dnssec-policy``
+
+  In these cases please add ``inline-signing yes;``
+  to individual zone configuration(s). Without applying this
+  change :iscman:`named` will fail to start. For more details see
+  https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
 
 New Features
 ~~~~~~~~~~~~