diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 0cbb5369ee..806ffb0a49 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -8271,6 +8271,8 @@ zone_nsec3chain(dns_zone_t *zone) {
 	 * generated by dns__zone_updatesigs() calls later in this function.
 	 */
 	while (nsec3chain != NULL && nodes-- > 0 && signatures > 0) {
+		dns_dbiterator_pause(nsec3chain->dbiterator);
+
 		LOCK_ZONE(zone);
 		nextnsec3chain = ISC_LIST_NEXT(nsec3chain, link);