diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
index 3b1767c506..a696f9d456 100644
--- a/bin/named/include/named/log.h
+++ b/bin/named/include/named/log.h
@@ -58,6 +58,14 @@ named_log_setsafechannels(isc_logconfig_t *lcfg);
  * Like named_log_setdefaultchannels(), but omits any logging to files.
  */
 
+void
+named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg);
+/*%
+ * If the SSLKEYLOGFILE environment variable is set, sets up a default
+ * logging channel for writing TLS pre-master secrets to the path stored
+ * in that environment variable (for debugging purposes).
+ */
+
 isc_result_t
 named_log_setdefaultcategory(isc_logconfig_t *lcfg);
 /*%
diff --git a/bin/named/log.c b/bin/named/log.c
index 2ae9282f96..39ae21117c 100644
--- a/bin/named/log.c
+++ b/bin/named/log.c
@@ -11,7 +11,10 @@
 
 /*! \file */
 
+#include <stdlib.h>
+
 #include <isc/result.h>
+#include <isc/util.h>
 
 #include <dns/log.h>
 
@@ -78,6 +81,8 @@ named_log_init(bool safe) {
 		goto cleanup;
 	}
 
+	named_log_setdefaultsslkeylogfile(lcfg);
+
 	return (ISC_R_SUCCESS);
 
 cleanup:
@@ -167,6 +172,41 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 #endif /* if ISC_FACILITY != LOG_DAEMON */
 }
 
+/*
+ * If the SSLKEYLOGFILE environment variable is set, TLS pre-master secrets are
+ * logged (for debugging purposes) to the file whose path is provided in that
+ * variable.  Set up a default logging channel which maintains up to 10 files
+ * containing TLS pre-master secrets, each up to 100 MB in size.  If the
+ * SSLKEYLOGFILE environment variable is set to the string "config", suppress
+ * creation of the default channel, allowing custom logging channel
+ * configuration for TLS pre-master secrets to be provided via the "logging"
+ * stanza in the configuration file.
+ */
+void
+named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
+	const char *sslkeylogfile_path = getenv("SSLKEYLOGFILE");
+	isc_logdestination_t destination = {
+		.file = {
+			.name = sslkeylogfile_path,
+			.versions = 10,
+			.suffix = isc_log_rollsuffix_timestamp,
+			.maximum_size = 100 * 1024 * 1024,
+		},
+	};
+	isc_result_t result;
+
+	if (sslkeylogfile_path == NULL ||
+	    strcmp(sslkeylogfile_path, "config") == 0) {
+		return;
+	}
+
+	isc_log_createchannel(lcfg, "default_sslkeylogfile", ISC_LOG_TOFILE,
+			      ISC_LOG_INFO, &destination, 0);
+	result = isc_log_usechannel(lcfg, "default_sslkeylogfile",
+				    ISC_LOGCATEGORY_SSLKEYLOG, NULL);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
 isc_result_t
 named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result = ISC_R_SUCCESS;
diff --git a/bin/named/logconf.c b/bin/named/logconf.c
index 68dd83773e..960385834a 100644
--- a/bin/named/logconf.c
+++ b/bin/named/logconf.c
@@ -326,6 +326,7 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 
 	if (logconfig != NULL) {
 		named_log_setdefaultchannels(logconfig);
+		named_log_setdefaultsslkeylogfile(logconfig);
 	}
 
 	(void)cfg_map_get(logstmt, "channel", &channels);
diff --git a/bin/named/server.c b/bin/named/server.c
index 8943ce7e17..1467efa191 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -9321,6 +9321,7 @@ load_configuration(const char *filename, named_server_t *server,
 			       "configuring logging");
 		} else {
 			named_log_setdefaultchannels(logc);
+			named_log_setdefaultsslkeylogfile(logc);
 			CHECKM(named_log_setunmatchedcategory(logc),
 			       "setting up default 'category unmatched'");
 			CHECKM(named_log_setdefaultcategory(logc),