Add change and release note for #3381

Because folks want to know.

(cherry picked from commit 2b95c11905a1a5faff9efa97a4f2498aadfa467b)

diff --git a/CHANGES b/CHANGES
index 3598e9c0cebdeee9132778a0f96487c1dfa40e37..df6b87e38d3943a2d8d4c5b3cec9cea5dfb78fea 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -34,6 +34,9 @@
 5942.  [bug]           Fix tkey.c:buildquery() function's error handling by
                        adding the missing cleanup code. [GL #3492]
 
+5941.  [func]          Zones with dnssec-policy now require dynamic DNS or
+                       inline-siging to be configured explicitly. [GL #3381]
+
 5938.  [bug]           An integer type overflow could cause an assertion
                        failure when freeing memory. [GL #3483]
 

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0937570736d0459e4d8cfeadf379017ac8000c7a..8e177646b932a8448669453d3f0b1c10e756b79d 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -35,7 +35,8 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
-- None.
+- Zones using ``dnssec-policy`` now require dynamic DNS or
+  ``inline-signing`` to be configured explicitly :gl:`#3381`.
 
 - When reconfiguring ``dnssec-policy`` from using NSEC with an NSEC-only DNSKEY
   algorithm (e.g. RSASHA1) to a policy that uses NSEC3, BIND will no longer fail