diff --git a/CHANGES b/CHANGES
index 931f231a9f..ed6a1e4107 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+1518.   [bug]           dns_nsec_buildrdata(), and hence dns_nsec_build(),
+			contained a off-by-one error when working out the
+			number of octets in the bitmap.
+
 1517.   [placeholder]
 
 1516.   [func]          Roll the DNSSEC types to RRSIG, NSEC and DNSKEY.
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 5997b4a103..6129471ebd 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec.c,v 1.2 2003/09/30 06:00:39 marka Exp $ */
+/* $Id: nsec.c,v 1.3 2003/10/01 04:07:27 marka Exp $ */
 
 #include <config.h>
 
@@ -119,7 +119,7 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version,
 	if (result != ISC_R_NOMORE)
 		return (result);
 
-	r.length += ((max_type + 7) / 8);
+	r.length += max_type / 8 + 1;
 	INSIST(r.length <= DNS_NSEC_BUFFERSIZE);
 	dns_rdata_fromregion(rdata,
 			     dns_db_class(db),