diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 487afafe4b..d0f419bf51 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -4493,8 +4493,14 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
 	 * DNS_R_NXDOMAIN here means we have not loaded the root zone
 	 * mirror yet - but DNS_R_NXDOMAIN is not a valid return value
 	 * when doing recursion, we need to patch it.
+	 *
+	 * CNAME or DNAME means zone were added with that record
+	 * after the start of a recursion. It means we do not have
+	 * initialized correct hevent->foundname and have to fail.
 	 */
-	if (result == DNS_R_NXDOMAIN) {
+	if (result == DNS_R_NXDOMAIN || result == DNS_R_CNAME ||
+	    result == DNS_R_DNAME)
+	{
 		result = DNS_R_SERVFAIL;
 	}