diff --git a/CHANGES b/CHANGES
index 689d283673..79aacf233d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4312.	[bug]		dig's unknown dns and edns flags (MBZ value) logging
+			was not consistent. [RT #41600]
+
 4311.	[bug]		Prevent "rndc delzone" from being used on
 			response-policy zones. [RT #41593]
 
diff --git a/bin/tests/system/ednscompliance/tests.sh b/bin/tests/system/ednscompliance/tests.sh
index b8f3b9a3bd..3693fd77f2 100644
--- a/bin/tests/system/ednscompliance/tests.sh
+++ b/bin/tests/system/ednscompliance/tests.sh
@@ -38,10 +38,10 @@ if [ $ret != 0 ]; then echo "I:failed $reason"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo "I:check +ednsflags=0x80 sets flags to 0080 ($n)"
+echo "I:check +ednsflags=0x80 sets flags to 0x0080 ($n)"
 ret=0 reason=
 $DIG -p 5300 @10.53.0.1 +qr +norec +ednsflags=0x80 soa $zone > dig.out$n
-grep "MBZ: 0080" dig.out$n > /dev/null || { ret=1; reason="flags"; }
+grep "MBZ: 0x0080," dig.out$n > /dev/null || { ret=1; reason="flags"; }
 if [ $ret != 0 ]; then echo "I:failed $reason"; fi
 status=`expr $status + $ret`
 
diff --git a/lib/dns/message.c b/lib/dns/message.c
index e2d15e931b..7a7aa7b921 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -3327,7 +3327,7 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 		mbz &= ~DNS_MESSAGEEXTFLAG_DO;		/* Known Flags. */
 		if (mbz != 0) {
 			ADD_STRING(target, "; MBZ: ");
-			snprintf(buf, sizeof(buf), "%.4x ", mbz);
+			snprintf(buf, sizeof(buf), "0x%.4x", mbz);
 			ADD_STRING(target, buf);
 			ADD_STRING(target, ", udp: ");
 		} else