diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
index 1d09d9f4bd..1adaed2393 100644
--- a/bin/dnssec/dnssec-revoke.c
+++ b/bin/dnssec/dnssec-revoke.c
@@ -263,12 +263,10 @@ main(int argc, char **argv) {
 			dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
 			if (strcmp(oldname, newname) == 0)
 				goto cleanup;
-			if (access(oldname, F_OK) == 0)
-				unlink(oldname);
+			(void)unlink(oldname);
 			isc_buffer_clear(&buf);
 			dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
-			if (access(oldname, F_OK) == 0)
-				unlink(oldname);
+			(void)unlink(oldname);
 		}
 	} else {
 		dst_key_format(key, keystr, sizeof(keystr));
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 62685f30d6..619cb4e346 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -845,8 +845,8 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
 		dns_db_detachnode(db, &newnode);
 	} while (1);
 
-	if (result == ISC_R_NOMORE)
-		result = ISC_R_SUCCESS;
+	/* result cannot be ISC_R_NOMORE here */
+	INSIST(result != ISC_R_NOMORE);
 
  failure:
 	if (dbit != NULL)
diff --git a/lib/dns/time.c b/lib/dns/time.c
index b3d2c2d084..5dce072811 100644
--- a/lib/dns/time.c
+++ b/lib/dns/time.c
@@ -161,6 +161,14 @@ dns_time64_fromtext(const char *source, isc_int64_t *target) {
 	RANGE(1, 12, month);
 	RANGE(1, days[month - 1] +
 		 ((month == 2 && is_leap(year)) ? 1 : 0), day);
+#ifdef __COVERITY__
+	/*
+	 * Use a simplified range to silence Coverity warning (in
+	 * arithmetic with day below).
+	 */
+	RANGE(1, 31, day);
+#endif /* __COVERITY__ */
+
 	RANGE(0, 23, hour);
 	RANGE(0, 59, minute);
 	RANGE(0, 60, second);		/* 60 == leap second. */