diff --git a/changelog.md b/changelog.md
index c94a3b71..f827fb50 100644
--- a/changelog.md
+++ b/changelog.md
@@ -6,6 +6,7 @@
 * *Deprecation* The current translation file format using PHP arrays is now deprecated; the next major version will introduce a new format.
 * **SECURITY** Fixes CVE-2021-3603 that may permit untrusted code to be run from an address validator. See [SECURITY.md](SECURITY.md) for details.
 * The fix for this issue includes a minor BC break: callables injected into `validateAddress`, or indirectly through the `$validator` class property, may no longer be simple strings. If you want to inject your own validator, provide a closure instead of a function name.
+* Haraka message ID strings are now recognised
 
 ## Version 6.4.1 (April 29th, 2021)
 * **SECURITY** Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details