diff --git a/CHANGES b/CHANGES
index b939c7d35b..960659e079 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2013.	[bug]		Handle unexpected TSIGs on unsigned AXFR/IXFR
+			responses more gracefully. [RT #15941]
+
 2009.	[bug]		libbind: coverity fixes. [RT #15808]
 
 2005.	[bug]		libbind: Retransmission timeouts should be
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 3105c0eb53..19f6967397 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.112.2.9 2006/03/08 03:56:21 marka Exp $
+ * $Id: tsig.c,v 1.112.2.10 2006/05/02 04:19:47 marka Exp $
  */
 
 #include <config.h>
@@ -646,8 +646,11 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 
 	msg->verify_attempted = 1;
 
-	if (msg->tcp_continuation)
+	if (msg->tcp_continuation) {
+		if (tsigkey == NULL || msg->querytsig == NULL)
+			return (DNS_R_UNEXPECTEDTSIG);
 		return (tsig_verify_tcp(source, msg));
+	}
 
 	/*
 	 * There should be a TSIG record...