diff --git a/CHANGES b/CHANGES
index 69bd3f5079..59297237ed 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6001.	[bug]		Always call dns_adb_endudpfetch() after calling
+			dns_adb_beginudpfetch() for UDP queries in resolver.c,
+			in order to adjust back the quota. [GL #3598]
+
 6000.	[bug]		Fix a startup issue on Solaris systems with many
 			(reportedly > 510) CPUs. Thanks to Stacey Marshall from
 			Oracle for deep investigation of the problem. [GL #3563]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0f953cc038..abbae59fcf 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -46,3 +46,7 @@ Bug Fixes
 - BIND would fail to start on Solaris-based systems with hundreds of CPUs. This
   has been fixed. ISC would like to thank Stacey Marshall from Oracle for
   bringing this problem to our attention. :gl:`#3563`
+
+- In certain resolution scenarios quotas could be erroneously reached for
+  servers, including the configured forwarders, resulting in SERVFAIL answers
+  sent to the clients. This has been fixed. :gl:`#3598`
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 4f2e363b99..5d26ebd0ff 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -1422,11 +1422,11 @@ fctx_cancelquery(resquery_t **queryp, isc_time_t *finish, bool no_response,
 		}
 
 		dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor);
+	}
 
-		if ((query->options & DNS_FETCHOPT_TCP) == 0) {
-			/* Inform the ADB that we're ending a UDP fetch */
-			dns_adb_endudpfetch(fctx->adb, query->addrinfo);
-		}
+	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
+		/* Inform the ADB that we're ending a UDP fetch */
+		dns_adb_endudpfetch(fctx->adb, query->addrinfo);
 	}
 
 	/*
@@ -2279,7 +2279,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 		resquery_senddone, resquery_response, query, &query->id,
 		&query->dispentry);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_dispatch;
+		goto cleanup_udpfetch;
 	}
 
 	/* Connect the socket */
@@ -2290,6 +2290,14 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 
 	return (result);
 
+cleanup_udpfetch:
+	if (!RESQUERY_CANCELED(query)) {
+		if ((query->options & DNS_FETCHOPT_TCP) == 0) {
+			/* Inform the ADB that we're ending a UDP fetch */
+			dns_adb_endudpfetch(fctx->adb, addrinfo);
+		}
+	}
+
 cleanup_dispatch:
 	fctx_detach(&query->fctx);
 
@@ -2298,6 +2306,12 @@ cleanup_dispatch:
 	}
 
 cleanup_query:
+	LOCK(&res->buckets[fctx->bucketnum].lock);
+	if (ISC_LINK_LINKED(query, link)) {
+		atomic_fetch_sub_release(&fctx->nqueries, 1);
+		ISC_LIST_UNLINK(fctx->queries, query, link);
+	}
+	UNLOCK(&res->buckets[fctx->bucketnum].lock);
 
 	query->magic = 0;
 	dns_message_detach(&query->rmessage);