diff --git a/lib/dns/rbt-cachedb.c b/lib/dns/rbt-cachedb.c
index 09fc281617..363f44a180 100644
--- a/lib/dns/rbt-cachedb.c
+++ b/lib/dns/rbt-cachedb.c
@@ -728,7 +728,9 @@ find_coveringnsec(rbtdb_search_t *search, const dns_name_t *name,
 		}
 		header_prev = header;
 	}
-	if (found != NULL) {
+	if (found != NULL && found->trust == dns_trust_secure &&
+	    (foundsig == NULL || foundsig->trust == dns_trust_secure))
+	{
 		dns__rbtdb_bindrdataset(search->rbtdb, node, found, now,
 					nlocktype, rdataset DNS__DB_FLARG_PASS);
 		if (foundsig != NULL) {