diff --git a/CHANGES b/CHANGES
index d9767531c9..f665c937c1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6219.	[bug]		Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
+			[GL #4032]
+
 6215.	[protocol]	Return REFUSED to GSS-API TKEY requests if GSS-API
 			support is not configured. [GL #4225]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index add787ad93..86014c6b92 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -40,6 +40,10 @@ Bug Fixes
   flushed.  This has been fixed to not process queued already received queries
   over TCP while the server is in the "exclusive" mode.  :gl:`#4200`
 
+- Ignore :any:`max-zone-ttl` for :any:`dnssec-policy` "insecure",
+  otherwise some zones will not be loaded if they use a TTL value larger
+  than 86400. :gl:`#4032`.
+
 Known Issues
 ~~~~~~~~~~~~