diff --git a/CHANGES b/CHANGES
index 278fbae160..dc12241a5c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+3463. [doc] Clarify managed-keys syntax in ARM. [RT 32232]
+
+3462. [doc] Clarify server selection behavior of dig when using
+ -4 or -6 options. [RT #32181]
+
--- 9.9.3b1 released ---
3461. [bug] Negative responses could incorrectly have AD=1
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 8b5867bc2e..1ef0cbc77d 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -10171,8 +10171,8 @@ ns.domain.com.rpz-nsdname CNAME .
<command>managed-keys</command> Statement Grammar
managed-keys {
- string initial-key number number number string ;
- string initial-key number number number string ; ...
+ name initial-key flags protocol algorithm key-data ;
+ name initial-key flags protocol algorithm key-data ; ...
};
@@ -10280,13 +10280,16 @@ ns.domain.com.rpz-nsdname CNAME .
named.)
- If the dnssec-lookaside option is
+ If the dnssec-validation option is
set to auto, named
will automatically initialize a managed key for the
- zone dlv.isc.org. The key that is
- used to initialize the key maintenance process is built
- into named, and can be overridden
- from bindkeys-file.
+ root zone. Similarly, if the dnssec-lookaside
+ option is set to auto,
+ named will automatically initialize
+ a managed key for the zone dlv.isc.org.
+ In both cases, the key that is used to initialize the key
+ maintenance process is built into named,
+ and can be overridden from bindkeys-file.