diff --git a/CHANGES b/CHANGES
index 944496db2d..c0e6b5b0a8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6001.	[bug]		Always call dns_adb_endudpfetch() after calling
+			dns_adb_beginudpfetch() for UDP queries in resolver.c,
+			in order to adjust back the quota. [GL #3598]
+
 6000.	[bug]		Fix a startup issue on Solaris systems with many
 			(reportedly > 510) CPUs. Thanks to Stacey Marshall from
 			Oracle for deep investigation of the problem. [GL #3563]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 77092bd75a..e4729b039d 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -43,3 +43,7 @@ Bug Fixes
 - BIND would fail to start on Solaris-based systems with hundreds of CPUs. This
   has been fixed. ISC would like to thank Stacey Marshall from Oracle for
   bringing this problem to our attention. :gl:`#3563`
+
+- In certain resolution scenarios quotas could be erroneously reached for
+  servers, including the configured forwarders, resulting in SERVFAIL answers
+  sent to the clients. This has been fixed. :gl:`#3598`
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 5d1e7291ed..cc552ea33a 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -1427,11 +1427,11 @@ fctx_cancelquery(resquery_t **queryp, isc_time_t *finish, bool no_response,
 		}
 
 		dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor);
+	}
 
-		if ((query->options & DNS_FETCHOPT_TCP) == 0) {
-			/* Inform the ADB that we're ending a UDP fetch */
-			dns_adb_endudpfetch(fctx->adb, query->addrinfo);
-		}
+	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
+		/* Inform the ADB that we're ending a UDP fetch */
+		dns_adb_endudpfetch(fctx->adb, query->addrinfo);
 	}
 
 	/*
@@ -2316,7 +2316,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 		resquery_senddone, resquery_response, query, &query->id,
 		&query->dispentry);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_dispatch;
+		goto cleanup_udpfetch;
 	}
 
 	/* Connect the socket */
@@ -2327,6 +2327,14 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 
 	return (result);
 
+cleanup_udpfetch:
+	if (!RESQUERY_CANCELED(query)) {
+		if ((query->options & DNS_FETCHOPT_TCP) == 0) {
+			/* Inform the ADB that we're ending a UDP fetch */
+			dns_adb_endudpfetch(fctx->adb, addrinfo);
+		}
+	}
+
 cleanup_dispatch:
 	fctx_detach(&query->fctx);
 
@@ -2335,6 +2343,12 @@ cleanup_dispatch:
 	}
 
 cleanup_query:
+	LOCK(&fctx->bucket->lock);
+	if (ISC_LINK_LINKED(query, link)) {
+		atomic_fetch_sub_release(&fctx->nqueries, 1);
+		ISC_LIST_UNLINK(fctx->queries, query, link);
+	}
+	UNLOCK(&fctx->bucket->lock);
 
 	query->magic = 0;
 	dns_message_detach(&query->rmessage);