diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index da41e41981..10108d7501 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -306,6 +306,12 @@ is_insecure_referral(dns_validator_t *val, dns_name_t *name,
 		if (result != ISC_R_SUCCESS) {
 			return false;
 		}
+		if (set.trust < dns_trust_secure) {
+			if (dns_rdataset_isassociated(&set)) {
+				dns_rdataset_disassociate(&set);
+			}
+			goto trynsec3;
+		}
 	}
 
 	INSIST(set.type == dns_rdatatype_nsec);
@@ -337,6 +343,12 @@ trynsec3:
 			dns_rdataset_disassociate(&set);
 			continue;
 		}
+		if (set.trust < dns_trust_secure) {
+			if (dns_rdataset_isassociated(&set)) {
+				dns_rdataset_disassociate(&set);
+			}
+			continue;
+		}
 		dns_name_getlabel(&nsec3name, 0, &hashlabel);
 		isc_region_consume(&hashlabel, 1);
 		isc_buffer_init(&buffer, owner, sizeof(owner));
@@ -905,6 +917,10 @@ validator_callback_nsec(void *arg) {
 			val->authfail++;
 			FALLTHROUGH;
 		default:
+			if (val->nxset != NULL) {
+				val->nxset->attributes &=
+					~DNS_RDATASETATTR_NCACHE;
+			}
 			result = validate_nx(val, true);
 		}
 	}