diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index 81c6cc1037..bb94c98a18 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -362,7 +362,6 @@ main(int argc, char **argv) {
 	setup_logging(mctx, &log);
 
 	if (predecessor == NULL) {
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (label == NULL) {
 			fatal("the key label was not specified");
 		}
@@ -384,7 +383,6 @@ main(int argc, char **argv) {
 			      isc_result_totext(ret));
 		}
 
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (strchr(label, ':') == NULL) {
 			char *l;
 			int len;
@@ -396,13 +394,11 @@ main(int argc, char **argv) {
 			label = l;
 		}
 
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}
 
 		r.base = algname;
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&alg, &r);
 		if (ret != ISC_R_SUCCESS) {
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 30e16fb87f..f16d98257b 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -1180,12 +1180,10 @@ main(int argc, char **argv) {
 	}
 
 	if (ctx.predecessor == NULL && ctx.policy == NULL) {
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}
 		r.base = algname;
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&ctx.alg, &r);
 		if (ret != ISC_R_SUCCESS) {
diff --git a/bin/dnssec/dnssectool.h b/bin/dnssec/dnssectool.h
index bb18c69183..e0970e2ae6 100644
--- a/bin/dnssec/dnssectool.h
+++ b/bin/dnssec/dnssectool.h
@@ -43,8 +43,12 @@ extern uint8_t dtype[8];
 
 typedef void(fatalcallback_t)(void);
 
+#ifndef CPPCHECK
 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+#else /* CPPCHECK */
+#define fatal(...) exit(1)
+#endif
 
 void
 setfatalcallback(fatalcallback_t *callback);