diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 9494cb416d..09c78416ae 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -3290,11 +3290,12 @@ process_sit(dig_lookup_t *l, dns_message_t *msg,
 		len = sizeof(cookie);
 	}
 
+	INSIST(msg->sitok == 0 && msg->sitbad == 0);
 	if (optlen >= len && optlen >= 8U) {
 		if (memcmp(isc_buffer_current(optbuf), sit, 8) == 0) {
 			msg->sitok = 1;
 		} else {
-			printf(";; Warning: SIT client cookie part mis-match\n");
+			printf(";; Warning: SIT client cookie mismatch\n");
 			msg->sitbad = 1;
 		}
 	} else {
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 29852030cb..7a3df5a13a 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -7033,6 +7033,8 @@ process_opt(resquery_t *query, dns_rdataset_t *opt) {
 			case DNS_OPT_SIT:
 				sit = isc_buffer_current(&optbuf);
 				compute_cc(query, cookie, sizeof(cookie));
+				INSIST(query->fctx->rmessage->sitbad == 0 &&
+				       query->fctx->rmessage->sitok == 0);
 				if (optlen >= 8U &&
 				    memcmp(cookie, sit, 8) == 0) {
 					query->fctx->rmessage->sitok = 1;