diff --git a/lib/ns/query.c b/lib/ns/query.c
index 7b35fbe763..9b868287d7 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -1910,8 +1910,8 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 			     DNS_TRUST_GLUE(rdataset->trust)))
 			{
 				/* validate() may change rdataset->trust */
-				invalid = validate(client, db, fname,
-						   rdataset, sigrdataset);
+				invalid = !validate(client, db, fname,
+						    rdataset, sigrdataset);
 			}
 			if (invalid && DNS_TRUST_PENDING(rdataset->trust)) {
 				dns_rdataset_disassociate(rdataset);
@@ -1982,8 +1982,8 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 			     DNS_TRUST_GLUE(rdataset->trust)))
 			{
 				/* validate() may change rdataset->trust */
-				invalid = validate(client, db, fname,
-						   rdataset, sigrdataset);
+				invalid = !validate(client, db, fname,
+						    rdataset, sigrdataset);
 			}
 
 			if (invalid && DNS_TRUST_PENDING(rdataset->trust)) {