Add CHANGES and release notes for [GL #4373]

diff --git a/CHANGES b/CHANGES
index b9e4a349c57f9bdf20110621266b30fa02b51600..92fcf6ac27561ac64619f223172885b8a5ea7280 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+6335.  [func]          The 'dnssec-validation yes' option now requires an
+                       explicitly configured 'trust-anchors' statement (or
+                       'managed-keys' or 'trusted-keys' statements, both
+                       deprecated). [GL #4373]
+
 6334.  [doc]           Improve ARM parental-agents definition. [GL #4531]
 
 6333.  [bug]           Fix the DNS_GETDB_STALEFIRST flag, which was defined

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 9aa27c16aeffcc4b2add6b460b7fed66d9343b7b..d45494484b8f508e3d2ff1e8e0b82f1f65f87ffd 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -41,7 +41,10 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
-- None.
+- The ``dnssec-validation yes`` option now requires an explicitly configured
+  :any:`trust-anchors` statement. If using manual trust anchors is not
+  operationally required, then please consider using ``dnssec-validation auto``
+  instead. :gl:`#4373`
 
 Bug Fixes
 ~~~~~~~~~