diff --git a/CHANGES b/CHANGES
index 6cc81c3c0c..e1bbed3835 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3547.	[bug]		Some malformed unknown rdata records were not properly
+			detected and rejected. [RT #33129]
+
 	--- 9.6-ESV-R9rc1 released ---
 
 3546.	[func]		Add EUI48 and EUI64 types. [RT #33082]
diff --git a/bin/tests/system/unknown/clean.sh b/bin/tests/system/unknown/clean.sh
index 22be4cbc49..a4c54943a6 100644
--- a/bin/tests/system/unknown/clean.sh
+++ b/bin/tests/system/unknown/clean.sh
@@ -17,7 +17,7 @@
 
 # $Id: clean.sh,v 1.7 2007/09/26 03:22:44 marka Exp $
 
-rm -f dig.out
+rm -f dig.out check.out
 rm -f */named.memstats
 rm -f */*.bk
 rm -f */*.bk.*
diff --git a/bin/tests/system/unknown/tests.sh b/bin/tests/system/unknown/tests.sh
index 0e2fb23710..3c09c13f79 100644
--- a/bin/tests/system/unknown/tests.sh
+++ b/bin/tests/system/unknown/tests.sh
@@ -161,12 +161,21 @@ echo '"#" "2" "0145"' | diff - dig.out || ret=1
 [ $ret = 0 ] || echo "I: failed"
 status=`expr $status + $ret`
 
-echo "I:check that '"'TXT \# text'"' is not treated as the unknown escape sequence"
+echo "I:check that 'TXT \# text' is not treated as the unknown escape sequence"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 +tcp +short txt9.example txt > dig.out
 echo '"#" "text"' | diff - dig.out || ret=1
 [ $ret = 0 ] || echo "I: failed"
 status=`expr $status + $ret`
 
+echo "I:check that 'TYPE353 \# cat' produces 'not a valid number'"
+ret=0
+$CHECKZONE nan.bad zones/nan.bad > check.out 2>&1
+grep "not a valid number" check.out > /dev/null || ret=1
+[ $ret = 0 ] || echo "I: failed"
+status=`expr $status + $ret`
+
+
+
 echo "I:exit status: $status"
 exit $status
diff --git a/bin/tests/system/unknown/zones/nan.bad b/bin/tests/system/unknown/zones/nan.bad
new file mode 100644
index 0000000000..d8578b31cb
--- /dev/null
+++ b/bin/tests/system/unknown/zones/nan.bad
@@ -0,0 +1 @@
+@ 0 IN TYPE353 \# cat 010101010101010101
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index dadf9b3ef0..998a946b31 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -608,9 +608,9 @@ unknown_fromtext(dns_rdataclass_t rdclass, dns_rdatatype_t type,
 	if (type == 0 || dns_rdatatype_ismeta(type))
 		return (DNS_R_METATYPE);
 
-	result = isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
-					ISC_FALSE);
-	if (result == ISC_R_SUCCESS && token.value.as_ulong > 65535U)
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+					ISC_FALSE));
+	if (token.value.as_ulong > 65535U)
 		return (ISC_R_RANGE);
 	result = isc_buffer_allocate(mctx, &buf, token.value.as_ulong);
 	if (result != ISC_R_SUCCESS)