Add change entry and release note for #3486

News worthy.

(cherry picked from commit 2669eb2a34ef65935f8045a6c9d271af486f38d5)

diff --git a/CHANGES b/CHANGES
index 1dade4b8caa00466da8d4174f3422d8dc90171ea..d3f64a1ac97b5fb77d9a28d5c62f53788f5ed24c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5947.  [func]          Change dnssec-policy to allow graceful transition from
+                       an NSEC only zone to NSEC3. [GL #3486]
+
 5946.  [bug]           Fix statistics channel's handling of multiple HTTP
                        requests in a single connection which have non-empty
                        request bodies. [GL #3463]

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 3700e9a3a167f57604f934b39c99873431bc5754..845aa8dba1f73f5415b5fd7e82cebacd5b4e3bcb 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -37,6 +37,12 @@ Feature Changes
 
 - None.
 
+- When reconfiguring ``dnssec-policy`` from using NSEC with an NSEC-only DNSKEY
+  algorithm (e.g. RSASHA1) to a policy that uses NSEC3, BIND will no longer fail
+  to sign the zone, but keep using NSEC for a little longer until the offending
+  DNSKEY records have been removed from the zone, then switch to using NSEC3.
+  :gl:`#3486`
+
 Bug Fixes
 ~~~~~~~~~