diff --git a/CHANGES b/CHANGES
index 719a3e4db8..1438076aa1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6061.	[bug]		Fix unexpected "Prohibited" extended DNS error
+			on allow-recursion. [GL #3743]
+
 6060.	[bug]		Fix a use-after-free bug in dns_zonemgr_releasezone()
 			by detaching from the zone manager outside of the write
 			lock. [GL #3768]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index f6c1447c11..3ea4eb49fe 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -66,6 +66,9 @@ Bug Fixes
   configured forwarders, resulting in SERVFAIL answers being sent to clients.
   This has been fixed. :gl:`#3752`
 
+- Clients may see an unexpected "Prohibited" extended DNS error when ``named``
+  is configured with :any:`allow-recursion`). :gl:`#3743`
+
 Known Issues
 ~~~~~~~~~~~~