diff --git a/doc/Changelog b/doc/Changelog
index dbe4a59c9..6ed2754df 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,7 +2,9 @@
 	- Can set tls authentication with forward-addr: IP#tls.auth.name
 	  And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".
 	  such as forward-addr: 9.9.9.9@853#dns.quad9.net or
-	  1.1.1.1@853#cloudflare-dns.com (RFC 8310).
+	  1.1.1.1@853#cloudflare-dns.com
+	- Fix #658: unbound using TLS in a forwarding configuration does not
+	  verify the server's certificate (RFC 8310 support).
 
 18 April 2018: Wouter
 	- Fix auth-zone retry timer to be on schedule with retry timeout,