diff --git a/CHANGES b/CHANGES
index 3598e9c0ce..df6b87e38d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -34,6 +34,9 @@
 5942.	[bug]		Fix tkey.c:buildquery() function's error handling by
 			adding the missing cleanup code. [GL #3492]
 
+5941.	[func]		Zones with dnssec-policy now require dynamic DNS or
+			inline-siging to be configured explicitly. [GL #3381]
+
 5938.	[bug]		An integer type overflow could cause an assertion
 			failure when freeing memory. [GL #3483]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0937570736..8e177646b9 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -35,7 +35,8 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
-- None.
+- Zones using ``dnssec-policy`` now require dynamic DNS or
+  ``inline-signing`` to be configured explicitly :gl:`#3381`.
 
 - When reconfiguring ``dnssec-policy`` from using NSEC with an NSEC-only DNSKEY
   algorithm (e.g. RSASHA1) to a policy that uses NSEC3, BIND will no longer fail