+6211. [func] Remove 'auto-dnssec'. This obsoletes the configuration
+ options 'dnskey-sig-validity', 'dnssec-dnskey-kskonly',
+ 'dnssec-update-mode', 'sig-validity-interval', and
+ 'update-check-ksk'. [GL #3672]
+
6210. [func] Don't add signing records for DNSKEY added with dynamic
update. The dynamic update DNSSEC management feature was
removed with GL #3686. [GL !8070]
``--with-tuning`` option) has either been removed or changed to a
sensible default. :gl:`#3664`
-- The :any:`auto-dnssec` option has been deprecated and will be removed
+- The ``auto-dnssec`` option has been deprecated and will be removed
in a future BIND 9.19.x release. Please migrate to
:any:`dnssec-policy`. :gl:`#3667`
Removed Features
~~~~~~~~~~~~~~~~
-- None.
+- The 'auto-dnssec' configuration option has now been removed. Please
+ use :any:`dnssec-policy` or manual signing instead. The following options
+ have become obsolete: :any:`dnskey-sig-validity`, :any:`dnssec-dnskey-kskonly`,
+ :any:`dnssec-update-mode`, :any:`sig-validity-interval`, and
+ :any:`update-check-ksk`. :gl:`#3672`.
Feature Changes
~~~~~~~~~~~~~~~