diff --git a/bind.keys.h b/bind.keys.h
index 0c4b4771c0..746dfa289d 100644
--- a/bind.keys.h
+++ b/bind.keys.h
@@ -1,3 +1,5 @@
+#ifndef BIND_KEYS_H
+#define BIND_KEYS_H 1
 #define TRUSTED_KEYS "\
 # The bind.keys file is used to override the built-in DNSSEC trust anchors\n\
 # which are included as part of BIND 9.  The only trust anchors it contains\n\
@@ -103,3 +105,4 @@ managed-keys {\n\
                 R1AkUTV74bU=\";\n\
 };\n\
 "
+#endif /* BIND_KEYS_H */
diff --git a/util/bindkeys.pl b/util/bindkeys.pl
index b149da0165..0fd5856062 100755
--- a/util/bindkeys.pl
+++ b/util/bindkeys.pl
@@ -9,8 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-# $Id: bindkeys.pl,v 1.7 2011/01/04 23:47:13 tbox Exp $
-
 use strict;
 use warnings;
 
@@ -31,6 +29,9 @@ $lines =~ s/managed-keys/trusted-keys/;
 $lines =~ s/\s+initial-key//g;
 my $tkey = '#define TRUSTED_KEYS "\\' . "\n" . $lines . "\"\n";
 
+print "#ifndef BIND_KEYS_H\n";
+print "#define BIND_KEYS_H 1\n";
 print $tkey;
 print "\n";
 print $mkey;
+print "#endif /* BIND_KEYS_H */\n";