diff --git a/doc/Changelog b/doc/Changelog
index 6fdcd1c3c..6b5cfae30 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,7 @@
 	- Fixup strict aliasing warning in iter priv code.
 	  and config_file code.
 	- iana portlist updated.
+	- harden-referral-path: handle cases where NS is in answer section.
 
 18 June 2009: Wouter
 	- Fix of message parse bug where (specifically) an NSEC and RRSIG
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 4ed06d779..9095a8841 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -1513,9 +1513,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			   /* we know that all other NS rrsets are scrubbed
 			    * away, thus on referral only one is left.
 			    * see if that equals the query name... */
-			&& reply_find_rrset_section_ns(iq->response->rep,
+			&& ( /* auth section, but sometimes in answer section*/
+			  reply_find_rrset_section_ns(iq->response->rep,
 				qstate->qinfo.qname, qstate->qinfo.qname_len,
 				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+			  || reply_find_rrset_section_an(iq->response->rep,
+				qstate->qinfo.qname, qstate->qinfo.qname_len,
+				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+			  )
 		    )) {
 			/* Store the referral under the current query */
 			if(!iter_dns_store(qstate->env, &iq->response->qinfo,