diff --git a/CHANGES b/CHANGES
index d9ffc581cf..e3db5f3a4e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2518.	[func]		Add support for the new CERT types from RFC 4398.
+			[RT #19077]
+
 2517.	[bug]		dig +trace with -4 or -6 failed when it chose a
 			nameserver address of the unsupported address.
 			[RT #18843]
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
index 58ade8587e..faa1d528ca 100644
--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rcode.c,v 1.8 2008/09/25 04:02:38 tbox Exp $ */
+/* $Id: rcode.c,v 1.9 2008/12/16 05:04:47 marka Exp $ */
 
 #include <config.h>
 #include <ctype.h>
@@ -79,12 +79,17 @@
 	{ dns_tsigerror_badtrunc, "BADTRUNC", 0}, \
 	{ 0, NULL, 0 }
 
-/* RFC2538 section 2.1 */
+/* RFC4398 section 2.1 */
 
 #define CERTNAMES \
 	{ 1, "PKIX", 0}, \
 	{ 2, "SPKI", 0}, \
 	{ 3, "PGP", 0}, \
+	{ 4, "IPKIX", 0}, \
+	{ 5, "ISPKI", 0}, \
+	{ 6, "IPGP", 0}, \
+	{ 7, "ACPKIX", 0}, \
+	{ 8, "IACPKIX", 0}, \
 	{ 253, "URI", 0}, \
 	{ 254, "OID", 0}, \
 	{ 0, NULL, 0}