diff --git a/CHANGES b/CHANGES
index c76567bcab..2323d27003 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6396.	[func]		Outgoing zone transfers are no longer enabled by
+			default. To enable them, an "allow-transfer" ACL
+			must be specified. [GL #4728]
+
 6395.	[bug]		Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c.
 			[GL #4736]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0b57512d6e..ee6f2ef748 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -32,7 +32,9 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
-- None.
+- Outgoing zone transfers are no longer enabled by default. An explicit
+  :any:`allow-transfer` ACL must now be set at the :any:`zone`, :any:`view` or
+  :namedconf:ref:`options` level to enable outgoing transfers. :gl:`#4728`
 
 Bug Fixes
 ~~~~~~~~~