diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 50f88209dd..7410431284 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6825,6 +6825,13 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 		return true;
 	}
 
+	/*
+	 * deny-answer-address doesn't apply to non-IN classes.
+	 */
+	if (rdataset->rdclass != dns_rdataclass_in) {
+		return true;
+	}
+
 	/*
 	 * Otherwise, search the filter list for a match for each
 	 * address record.  If a match is found, the address should be