diff --git a/draft-ietf-quic-tls.md b/draft-ietf-quic-tls.md
index 4c5b0e3af5..ecab0368c0 100644
--- a/draft-ietf-quic-tls.md
+++ b/draft-ietf-quic-tls.md
@@ -447,7 +447,7 @@ network, it proceeds as follows:
   find the proper location in the data sequence.  If the result of this process
   is that new data is available, then it is delivered to TLS in order.
 
-- If the packet is from a previously installed encryption level, it MUST not
+- If the packet is from a previously installed encryption level, it MUST NOT
   contain data which extends past the end of previously received data in that
   flow. Implementations MUST treat any violations of this requirement as a
   connection error of type PROTOCOL_VIOLATION.