diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 65f7cd1c21..4202cba4cb 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -577,7 +577,15 @@ signname(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	dns_rdataset_t rdataset, nsset;
 	dns_rdatasetiter_t *rdsiter;
 	isc_boolean_t isdelegation = ISC_FALSE;
+	static int warnwild = 0;
 
+	if (dns_name_iswildcard(name)) {
+		fprintf(stderr, "Warning: wildcard name seen: %s\n",
+			nametostr(name));
+		if (warnwild++ == 0)
+			fprintf(stderr, "\tBIND 9 doesn't completely handle "
+				"wildcards in secure zones\n");
+	}
 	if (!atorigin) {
 		dns_rdataset_init(&nsset);
 		result = dns_db_findrdataset(db, node, version,
diff --git a/bin/tests/signer.c b/bin/tests/signer.c
index 65f7cd1c21..4202cba4cb 100644
--- a/bin/tests/signer.c
+++ b/bin/tests/signer.c
@@ -577,7 +577,15 @@ signname(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	dns_rdataset_t rdataset, nsset;
 	dns_rdatasetiter_t *rdsiter;
 	isc_boolean_t isdelegation = ISC_FALSE;
+	static int warnwild = 0;
 
+	if (dns_name_iswildcard(name)) {
+		fprintf(stderr, "Warning: wildcard name seen: %s\n",
+			nametostr(name));
+		if (warnwild++ == 0)
+			fprintf(stderr, "\tBIND 9 doesn't completely handle "
+				"wildcards in secure zones\n");
+	}
 	if (!atorigin) {
 		dns_rdataset_init(&nsset);
 		result = dns_db_findrdataset(db, node, version,