diff --git a/doc/Changelog b/doc/Changelog
index f6933cfbd..df4dee6a6 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -7,6 +7,7 @@
 	  not overwrite valid cache entry with SERVFAIL.
 	- auth-zone give SERVFAIL when expired, fallback activates when
 	  expired, and this is documented in the man page.
+	- stat count SERVFAIL downstream auth-zone queries for expired zones.
 
 26 November 2018: Wouter
 	- Fix to not set GLOB_NOSORT so the unbound.conf include: files are
diff --git a/services/authzone.c b/services/authzone.c
index 14ae7b74f..b58590e40 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -3267,6 +3267,9 @@ int auth_zones_answer(struct auth_zones* az, struct module_env* env,
 			return 0;
 		}
 		lock_rw_unlock(&z->lock);
+		lock_rw_wrlock(&az->lock);
+		az->num_query_down++;
+		lock_rw_unlock(&az->lock);
 		auth_error_encode(qinfo, env, edns, repinfo, buf, temp,
 			LDNS_RCODE_SERVFAIL);
 		return 1;