Add changes and notes for [#2498]

(cherry picked from commit 89c47b3b42c30fecdc515bee1dfbd954f29aeec0)

diff --git a/CHANGES b/CHANGES
index 732f85bd8b6c150d7846152cbb943994b702e80a..6d99a0a3e1792ca918dc35e9598578d50c8deb1b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5590.  [bug]           Process NSEC3PARAM queue when loading a dynamic zone.
+                       This will immediately create NSEC3 records for zones
+                       that use "dnssec-policy" and "nsec3param". [GL #2498]
+
 5588.  [func]          Add "purge-keys" option to "dnssec-policy". This sets
                        the time how long key files should be retained after
                        they have become obsolete. [GL #2408]

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0a0437cdc8b8bb59f6b4a807e7d42f06f6adfd3b..de5a1cbb90b2b4406ccd55c14e71bc1852556069 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -54,5 +54,8 @@ Bug Fixes
   UDP sockets that we enabled during the DNS Flag Day 2020 to fix this issue.
   [GL #2487]
 
+- NSEC3 records were not immediately created when signing a dynamic zone with
+  ``dnssec-policy`` and ``nsec3param``. This has been fixed [GL #2498].
+
 - An invalid direction field (not one of 'N'/'S' or 'E'/'W') in a LOC record
   triggered an INSIST failure. [GL #2499]