diff --git a/CHANGES b/CHANGES
index 6ad4ac890f..4be8c4465d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,9 @@
 			effect, and a warning will be logged that
 			the feature should no longer be used. [GL #3773]
 
+6061.	[bug]		Fix unexpected "Prohibited" extended DNS error
+			on allow-recursion. [GL #3743]
+
 6059.	[bug]		In some serve stale scenarios, like when following an
 			expired CNAME record, named could return SERVFAIL if the
 			previous request wasn't successful. Consider non-stale
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 49aba2e7b6..d8c23bb200 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -61,6 +61,9 @@ Bug Fixes
   configured forwarders, resulting in SERVFAIL answers being sent to clients.
   This has been fixed. :gl:`#3752`
 
+- Clients may see an unexpected "Prohibited" extended DNS error when ``named``
+  is configured with :any:`allow-recursion`). :gl:`#3743`
+
 Known Issues
 ~~~~~~~~~~~~