diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index e5c4f72d2f..069a69ebc1 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -677,6 +677,15 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  *		DNS_R_NXRDATASET		The desired name exists, but
  *						the desired type does not.
  *
+ *		DNS_R_NXGLUE			The desired name exists, but
+ *						is at or beneath a zonecut.
+ *						The desired type does not
+ *						exist.  This result can only
+ *						occur if 'db' is a zone
+ *						database and the
+ *						DNS_DBFIND_GLUEOK option is
+ *						set.
+ *
  *		DNS_R_NOTFOUND			The desired name does not
  *						exist, and no delegation could
  *						be found.  This result can only
diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h
index 816328e263..6ee24e1894 100644
--- a/lib/dns/include/dns/result.h
+++ b/lib/dns/include/dns/result.h
@@ -94,8 +94,9 @@ typedef isc_result_t dns_result_t;	/* XXXRTH for legacy use only */
 #define DNS_R_INVALIDTIME		(ISC_RESULTCLASS_DNS + 44)
 #define DNS_R_EXPECTEDTSIG		(ISC_RESULTCLASS_DNS + 45)
 #define DNS_R_UNEXPECTEDTSIG		(ISC_RESULTCLASS_DNS + 46)
+#define DNS_R_NXGLUE			(ISC_RESULTCLASS_DNS + 47)
 
-#define DNS_R_NRESULTS			47	/* Number of results */
+#define DNS_R_NRESULTS			48	/* Number of results */
 
 /*
  * DNS wire format rcodes
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 7dbbc0a58f..f98eef00bd 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -1828,7 +1828,22 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		if (search.zonecut != NULL) {
 		    /*
 		     * We were trying to find glue at a node beneath a
-		     * zone cut, but didn't, so we return the delegation.
+		     * zone cut, but didn't.
+		     */
+		    if ((search.options & DNS_DBFIND_GLUEOK) != 0) {
+			    /*
+			     * Finding glue is OK.  Tell the caller the
+			     * glue doesn't exist.
+			     */
+			    result = DNS_R_NXGLUE;
+			    if (nodep != NULL) {
+				    new_reference(search.rbtdb, node);
+				    *nodep = node;
+			    }
+			    goto node_exit;
+		    }
+		    /*
+		     * Return the delegation.
 		     */
 		    UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
 		    result = setup_delegation(&search, nodep, foundname,
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 6ea105b21b..45300376a4 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -74,6 +74,7 @@ static char *text[DNS_R_NRESULTS] = {
 	"invalid time",				/* 44 */
 	"expected a TSIG",			/* 45 */
 	"did not expect a TSIG",		/* 46 */
+	"glue does not exist",			/* 47 */
 };
 
 static char *rcode_text[DNS_R_NRCODERESULTS] = {