diff --git a/CHANGES b/CHANGES
index 464f770b1d..12dfb391b1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5554.	[bug]		dnssec-signzone and dnssec-verify where missing
+			newlines between log messages. [GL #2359]
+
 5553.	[bug]		When reconfiguring named, removing "auto-dnssec"
 			did not actually turn off DNSSEC maintenance.
 			This has been fixed. [GL #2341]
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index c33be78a5a..2337ec99b3 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -2728,10 +2728,13 @@ static void
 report(const char *format, ...) {
 	if (!quiet) {
 		FILE *out = output_stdout ? stderr : stdout;
+		char buf[4096];
 		va_list args;
+
 		va_start(args, format);
-		vfprintf(out, format, args);
+		vsnprintf(buf, sizeof(buf), format, args);
 		va_end(args);
+		fprintf(out, "%s\n", buf);
 	}
 }
 
diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
index 391da38e00..eb845ffbc8 100644
--- a/bin/dnssec/dnssec-verify.c
+++ b/bin/dnssec/dnssec-verify.c
@@ -82,10 +82,13 @@ static bool keyset_kskonly = false;
 static void
 report(const char *format, ...) {
 	if (!quiet) {
+		char buf[4096];
 		va_list args;
+
 		va_start(args, format);
-		vfprintf(stdout, format, args);
+		vsnprintf(buf, sizeof(buf), format, args);
 		va_end(args);
+		fprintf(stdout, "%s\n", buf);
 	}
 }