diff --git a/doc/Changelog b/doc/Changelog
index 013c1a342..6ccc5ebd7 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,7 @@
 1 October 2007: Wouter
 	- skip F77, CXX, objC tests in configure step.
+	- fixup crash in refetch glue after a CNAME.
+	  and protection against similar failures (with error print).
 
 28 September 2007: Wouter
 	- test case for unbound-checkconf, fixed so it also checks the
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 462edcc63..a424f6a31 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -706,6 +706,10 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	 * When re-fetching glue we also need to ask the parent.
 	 */
 	if(iq->refetch_glue) {
+		if(!iq->dp) {
+			log_err("internal or malloc fail: no dp for refetch");
+			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		}
 		delname = iq->dp->name;
 		delnamelen = iq->dp->namelen;
 	} else {
@@ -716,6 +720,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		&& !dname_is_root(delname)) {
 		/* do not adjust root label, remove first label from delname */
 		dname_remove_label(&delname, &delnamelen);
+		iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */
 	}
 	while(1) {