diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 549df9979c..1a7f7dd0c7 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -183,6 +183,7 @@ static unsigned int udp_timeout = 3;
 static unsigned int udp_retries = 3;
 static dns_rdataclass_t defaultclass = dns_rdataclass_in;
 static dns_rdataclass_t zoneclass = dns_rdataclass_none;
+static isc_mutex_t answer_lock;
 static dns_message_t *answer = NULL;
 static uint32_t default_ttl = 0;
 static bool default_ttl_set = false;
@@ -994,6 +995,8 @@ setup_system(void) {
 	} else if (keyfile != NULL) {
 		setup_keyfile(gmctx, glctx);
 	}
+
+	isc_mutex_init(&answer_lock);
 }
 
 static int
@@ -2193,9 +2196,11 @@ do_next_command(char *cmdline) {
 		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "answer") == 0) {
+		LOCK(&answer_lock);
 		if (answer != NULL) {
 			show_message(stdout, answer, "Answer:");
 		}
+		UNLOCK(&answer_lock);
 		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "key") == 0) {
@@ -2423,6 +2428,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 
+	LOCK(&answer_lock);
 	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &answer);
 	check_result(result, "dns_message_create");
 	result = dns_request_getresponse(request, answer,
@@ -2476,6 +2482,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 	if (debugging) {
 		show_message(stderr, answer, "\nReply from update query:");
 	}
+	UNLOCK(&answer_lock);
 
 done:
 	dns_request_destroy(&request);
@@ -3222,9 +3229,11 @@ start_update(void) {
 
 	ddebug("start_update()");
 
+	LOCK(&answer_lock);
 	if (answer != NULL) {
 		dns_message_destroy(&answer);
 	}
+	UNLOCK(&answer_lock);
 
 	/*
 	 * If we have both the zone and the servers we have enough information
@@ -3303,9 +3312,11 @@ static void
 cleanup(void) {
 	ddebug("cleanup()");
 
+	LOCK(&answer_lock);
 	if (answer != NULL) {
 		dns_message_destroy(&answer);
 	}
+	UNLOCK(&answer_lock);
 
 #if HAVE_GSSAPI
 	if (tsigkey != NULL) {
@@ -3356,6 +3367,8 @@ cleanup(void) {
 		isc_mem_stats(gmctx, stderr);
 	}
 	isc_mem_destroy(&gmctx);
+
+	isc_mutex_destroy(&answer_lock);
 }
 
 static void