diff --git a/bin/tests/system/filters/ns1/unsigned.db b/bin/tests/system/filters/ns1/unsigned.db
index 2fc656e0ec..a7968e1cb6 100644
--- a/bin/tests/system/filters/ns1/unsigned.db
+++ b/bin/tests/system/filters/ns1/unsigned.db
@@ -23,3 +23,8 @@ dual		A	1.0.0.6
 dual 		AAAA	2001:db8::6
 mx		A	1.0.0.3
 mx 		AAAA	2001:db8::3
+
+; one of these AAAA addresses is excluded in named.conf
+excludeone	A	1.0.0.6
+excludeone	AAAA	::1
+excludeone	AAAA	2001:db8::6
diff --git a/bin/tests/system/filters/ns4/unsigned.db b/bin/tests/system/filters/ns4/unsigned.db
index d2aced2f2a..ef38ced877 100644
--- a/bin/tests/system/filters/ns4/unsigned.db
+++ b/bin/tests/system/filters/ns4/unsigned.db
@@ -23,3 +23,8 @@ dual		A	1.0.0.6
 dual 		AAAA	2001:db8::6
 mx		A	1.0.0.3
 mx 		AAAA	2001:db8::3
+
+; one of these AAAA addresses is excluded in named.conf
+excludeone	A	1.0.0.6
+excludeone	AAAA	::1
+excludeone	AAAA	2001:db8::6
diff --git a/bin/tests/system/filters/ns5/named.conf.j2 b/bin/tests/system/filters/ns5/named.conf.j2
index 36380cd321..37cb8d3fbb 100644
--- a/bin/tests/system/filters/ns5/named.conf.j2
+++ b/bin/tests/system/filters/ns5/named.conf.j2
@@ -23,9 +23,9 @@ options {
 	dnssec-validation no;
 	notify yes;
 	dns64 64:ff9b::/96 {
-			    clients { any; };
-			    exclude { any; };
-			    mapped { any; };
+		clients { any; };
+		exclude { ::1/128; };
+		mapped { any; };
 	};
 	minimal-responses no;
 };
diff --git a/bin/tests/system/filters/tests_filter_dns64.py b/bin/tests/system/filters/tests_filter_dns64.py
index dfa71b76c1..2f5409ddfd 100644
--- a/bin/tests/system/filters/tests_filter_dns64.py
+++ b/bin/tests/system/filters/tests_filter_dns64.py
@@ -25,3 +25,7 @@ def test_filter_dns64():
     msg = isctest.query.create("aaaa-only.unsigned", "aaaa")
     res = isctest.query.tcp(msg, "10.53.0.5")
     isctest.check.noerror(res)
+
+    msg = isctest.query.create("excludeone.unsigned", "aaaa")
+    res = isctest.query.tcp(msg, "10.53.0.5")
+    isctest.check.noerror(res)
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 39306d1dc4..231ad9f847 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -8250,6 +8250,10 @@ query_addanswer(query_ctx_t *qctx) {
 	} else if (qctx->client->query.dns64_aaaaok != NULL) {
 		query_filter64(qctx);
 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
+		isc_mem_cput(qctx->client->manager->mctx,
+			     qctx->client->query.dns64_aaaaok,
+			     qctx->client->query.dns64_aaaaoklen, sizeof(bool));
+		qctx->client->query.dns64_aaaaoklen = 0;
 	} else {
 		if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
 			query_prefetch(qctx->client, qctx->fname,