DNSSEC: do top-down search for limit of secure delegation.
diff --git a/CHANGELOG b/CHANGELOG
index 2b6356b..e8bf80f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -31,7 +31,16 @@
request for certain domains, before the correct answer can
arrive. Thanks to Glen Huang for the patch.
+ Revisit the part of DNSSEC validation which determines if an
+ unsigned answer is legit, or is in some part of the DNS
+ tree which should be signed. Dnsmasq now works from the
+ DNS root downward looking for the limit of signed
+ delegations, rather than working bottom up. This is
+ both more correct, and less likely to trip over broken
+ nameservers in the unsigned parts of the DNS tree
+ which don't respond well to DNSSEC queries.
+
version 2.72
Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.