diff --git a/doc/Changelog b/doc/Changelog
index 4c167852e..4ea9856b0 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+3 July 2017: Wouter
+	- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
+	  on.
+
 29 June 2017: Wouter
 	- Fix python example0 return module wait instead of error for pass.
 	- iana portlist update
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index 11df4415c..2088a8c61 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -427,8 +427,11 @@ morechecks(struct config_file* cfg, const char* fname)
 	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file,
 		cfg->chrootdir, cfg);
 #ifdef USE_IPSECMOD
-	check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook, cfg->chrootdir,
-		cfg);
+	if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
+		/* only check hook if enabled */
+		check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook,
+			cfg->chrootdir, cfg);
+	}
 #endif
 	/* remove chroot setting so that modules are not stripping pathnames*/
 	free(cfg->chrootdir);