diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 97fee68369..107891624b 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -877,6 +877,9 @@ dst_key_fromgssapi(dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx,
 	*keyp = key;
 	result = ISC_R_SUCCESS;
 out:
+	if (result != ISC_R_SUCCESS) {
+		dst_key_free(&key);
+	}
 	return result;
 }