Add CHANGES and notes for [#2517]

diff --git a/CHANGES b/CHANGES
index 11a16ebdc8b848f944126ec094ca3d83477374c8..313883173b9059c6b7438c8ae2c2ea4183213676 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5606.  [bug]           CDS/CDNSKEY DELETE records were not removed when a zone
+                       transitioned from secure to insecure. "named-checkzone"
+                       should not complain if such records exist in an
+                       unsigned zone. [GL #2517]
+
 5605.  [bug]           "dig -u" now uses CLOCK_REALTIME for more accurate
                        time reporting. [GL #2592]
 

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 149cf43fd03a54973971aef47d4425a819fc1002..2ebdff3f27fc4536c7af1535d9a5e68656e6afe3 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -42,6 +42,10 @@ Bug Fixes
 - Dynamic zones with ``dnssec-policy`` that were frozen could not be thawed.
   This has been fixed. [GL #2523]
 
+- CDS/CDNSKEY DELETE records are now removed when a zone transitioned from
+  secure to insecure. "named-checkzone" no longer complains if such records
+  exist in an unsigned zone. [GL #2517]
+
 - Fix a crash when transferring a zone over TLS, after "named" previously
   skipped a master. [GL #2562]