diff --git a/CHANGES b/CHANGES
index 9e73f227dc..f988e74bc7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5528.	[func]		Convert "dig", "host" and "nslookup" to use the
+			network manager. As a side effect of this change,
+			"dig +unexpected" no longer works, and has been
+			disabled. [GL #2140]
+
 5527.	[bug]		There was a NULL pointer dereference if the creation
 			of the fetch to determine if a negative trust anchor
 			was still valid failed. [GL #2244]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 23f9d8da2c..5f9257fa35 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -36,6 +36,16 @@ Feature Changes
 
 - None.
 
+- The ``dig``, ``host``, and ``nslookup`` tools have been converted to
+  use the new network manager API rather than the older ISC socket API.
+
+  As a side effect of this change, the ``dig +unexpected`` option no longer
+  works.  This could previously be used for diagnosing broken servers or
+  network configurations by listening for replies from servers other than
+  the one that was queried.  With the new API such answers are filtered
+  before they ever reach ``dig``.  Consequently, the option has been
+  removed. [GL #2140]
+
 Bug Fixes
 ~~~~~~~~~