578297
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
578297
index 2bc4461..d9de369 100644
578297
--- a/lib/dns/resolver.c
578297
+++ b/lib/dns/resolver.c
578297
@@ -6533,6 +6533,19 @@ answer_response(fetchctx_t *fctx) {
578297
 					log_formerr(fctx, "NSEC3 in answer");
578297
 					return (DNS_R_FORMERR);
578297
 				}
578297
+				if (rdataset->type == dns_rdatatype_tkey) {
578297
+					/*
578297
+					 * TKEY is not a valid record in a
578297
+					 * response to any query we can make.
578297
+					 */
578297
+					log_formerr(fctx, "TKEY in answer");
578297
+					return (DNS_R_FORMERR);
578297
+				}
578297
+				if (rdataset->rdclass != fctx->res->rdclass) {
578297
+					log_formerr(fctx, "Mismatched class "
578297
+						    "in answer");
578297
+					return (DNS_R_FORMERR);
578297
+				}
578297
 
578297
 				/*
578297
 				 * Apply filters, if given, on answers to reject
578297
@@ -6719,6 +6732,12 @@ answer_response(fetchctx_t *fctx) {
578297
 			     rdataset != NULL;
578297
 			     rdataset = ISC_LIST_NEXT(rdataset, link))
578297
 			{
578297
+				if (rdataset->rdclass != fctx->res->rdclass) {
578297
+					log_formerr(fctx, "Mismatched class "
578297
+						    "in answer");
578297
+					return (DNS_R_FORMERR);
578297
+				}
578297
+
578297
 				/*
578297
 				 * Only pass DNAME or RRSIG(DNAME).
578297
 				 */