diff --git a/CHANGES b/CHANGES
index 1d56ce6c1d..4f6d4bea0b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3756.	[bug]		GSSAPI Kerberos realm checking was broken in
+			check_config leading to spurious messages being
+			logged.  [RT #35443]
+
 3754.	[cleanup]	win32: Installer now places files in the
 			Program Files area rather than system services.
 			[RT #35361]
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index d4209d378a..915e6609a4 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -233,7 +233,7 @@ check_config(const char *gss_name) {
 		krb5_free_context(krb5_ctx);
 		return;
 	}
-	p = strchr(gss_name, '/');
+	p = strchr(gss_name, '@');
 	if (p == NULL) {
 		gss_log(ISC_LOG_ERROR, "badly formatted "
 			"tkey-gssapi-credentials (%s)", gss_name);