diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index ef5e72228e..26af274c00 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1074,6 +1074,13 @@ where ``tls-configuration-name`` refers to a previously defined
    observers but does not protect from man-in-the-middle attacks on
    zone transfers.
 
+.. warning::
+
+  Please note that this version of BIND 9 does not support dynamic updates
+  forwarding (see :any:`allow-update-forwarding`) in conjuction with zone
+  transfers over TLS (XoT), that is when the :any:`tls` keyword is used with
+  :any:`primaries`, e.g. ``primaries { 192.0.2.1 tls tls-configuration-name; };``.
+
 .. _options_grammar:
 
 ``options`` Block Grammar
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 3ab1293370..9239eca2be 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -20,7 +20,9 @@ Security Fixes
 Known Issues
 ~~~~~~~~~~~~
 
-- None.
+- BIND 9.18 does not support dynamic updates forwarding (see
+  :any:`allow-update-forwarding`) in conjuction with zone transfers
+  over TLS (XoT). :gl:`#3512`
 
 New Features
 ~~~~~~~~~~~~