diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index fa7c20e046..e01eed3ac2 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -276,7 +276,7 @@ strtokeystate(const char *str) {
 			return ((dst_key_state_t)i);
 		}
 	}
-	fatal("unknown key state");
+	fatal("unknown key state %s", str);
 }
 
 isc_stdtime_t