diff --git a/CHANGES b/CHANGES
index 4d751e957f..d4ccb4c444 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 5631.	[bug]		Update ZONEMD to match RFC 8976. [GL #2658]
 
+5630.	[func]		Treat DNSSEC responses with NSEC3 iterations greater
+			than 150 as insecure. [GL #2445]
+
 5629.	[func]		Reduce the supported maximum number of iterations
 			that can be configured in an NSEC3 zone to 150.
 			[GL #2642]