diff --git a/CHANGES b/CHANGES
index b1829727f8..c99f0f1263 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,8 @@
 
+3.1.0-dev.22 | 2019-08-12 13:31:12 -0700
+
+  * GH-535: fix typo of "C_HESIOD" in DNS::classes (Jon Siwek, Corelight)
+
 3.1.0-dev.21 | 2019-08-12 13:00:21 -0700
 
   * Add new distro to Travis CI configuration for running leak tests (Tim Wojtulewicz, Corelight)
diff --git a/NEWS b/NEWS
index b6c072e168..e48711b908 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,12 @@ Changed Functionality
   ``Known::AddrPortServTriplet`` and ``Known::services`` is now a table
   instead of just a set.
 
+- The DNS class name for Hesiod in the ``DNS::classes`` table is now spelled
+  correctly as "C_HESIOD" instead of "C_HESOD".  For reference, this
+  class name string may appear in the dns.log file or in any custom
+  script logic that inspects the ``qclass`` field of ``DNS::Info``
+  after a ``dns_request`` event.
+
 Removed Functionality
 ---------------------
 
diff --git a/VERSION b/VERSION
index 13ae017e98..dd467c2eca 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.1.0-dev.21
+3.1.0-dev.22
diff --git a/doc b/doc
index 56019a5297..dc8ac2dc13 160000
--- a/doc
+++ b/doc
@@ -1 +1 @@
-Subproject commit 56019a5297cd5d167e0febc6b0b33a32a9dbe96e
+Subproject commit dc8ac2dc1345ddb1ae5455466a795eac78d58aac
diff --git a/scripts/base/protocols/dns/consts.zeek b/scripts/base/protocols/dns/consts.zeek
index 4683a3e773..38dd077ec5 100644
--- a/scripts/base/protocols/dns/consts.zeek
+++ b/scripts/base/protocols/dns/consts.zeek
@@ -126,7 +126,7 @@ export {
 		[1]   = "C_INTERNET",
 		[2]   = "C_CSNET",
 		[3]   = "C_CHAOS",
-		[4]   = "C_HESOD",
+		[4]   = "C_HESIOD",
 		[254] = "C_NONE",
 		[255] = "C_ANY",
 	} &default = function(n: count): string { return fmt("qclass-%d", n); };