diff --git a/bin/tests/system/grease/tests.sh b/bin/tests/system/grease/tests.sh
index d88e810376..1bc9903fca 100644
--- a/bin/tests/system/grease/tests.sh
+++ b/bin/tests/system/grease/tests.sh
@@ -27,8 +27,8 @@ ret=0
 $DIG $DIGOPTS example @10.53.0.1 >dig.out.$n || ret=1
 grep "status: NOERROR" dig.out.$n >/dev/null || ret=1
 p1="grease-dns-flags: 10.53.0.2#[0-9]* example/A: DNS header flag 0x40 not zero"
-p2="grease-edns-flags: 10.53.0.2#[0-9]* example/A: Unspecified EDNS flags not zero: [0248]*"
-p3="grease-edns-negotiation: 10.53.0.2#[0-9]* example/A: EDNS version negotiation: rcode != BADVERS(16): 0"
+p2="grease-edns-flags: 10.53.0.2#[0-9]* example/A: Unspecified EDNS flags not zero: 0x[0248]*"
+p3="grease-edns-negotiation: 10.53.0.2#[0-9]* example/A: EDNS version negotiation: unexpected rcode: NOERROR"
 grep "$p1" ns1/named.run >/dev/null || ret=1
 grep "$p2" ns1/named.run >/dev/null || ret=1
 grep "$p3" ns1/named.run >/dev/null || ret=1
@@ -43,8 +43,8 @@ ret=0
 $DIG $DIGOPTS nxdomain.example @10.53.0.1 >dig.out.$n || ret=1
 grep "status: NXDOMAIN" dig.out.$n >/dev/null || ret=1
 p1="grease-dns-flags: 10.53.0.2#[0-9]* nxdomain.example/A: DNS header flag 0x40 not zero"
-p2="grease-edns-flags: 10.53.0.2#[0-9]* nxdomain.example/A: Unspecified EDNS flags not zero: [0248]*"
-p3="grease-edns-negotiation: 10.53.0.2#[0-9]* nxdomain.example/A: EDNS version negotiation: rcode != BADVERS(16): 3"
+p2="grease-edns-flags: 10.53.0.2#[0-9]* nxdomain.example/A: Unspecified EDNS flags not zero: 0x[0248]*"
+p3="grease-edns-negotiation: 10.53.0.2#[0-9]* nxdomain.example/A: EDNS version negotiation: unexpected rcode: NXDOMAIN"
 grep "$p1" ns1/named.run >/dev/null || ret=1
 grep "$p2" ns1/named.run >/dev/null || ret=1
 grep "$p3" ns1/named.run >/dev/null || ret=1
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 5b678e5a42..2e6066fa72 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -8401,7 +8401,7 @@ rctx_edns(respctx_t *rctx) {
 		if ((ednsflags & query->grease_ednsflags) != 0) {
 			log_grease(fctx, "grease-edns-flags",
 				   "Unspecified EDNS flags not zero: "
-				   "%04x" GREASE_NSID_FMT,
+				   "%#04x" GREASE_NSID_FMT,
 				   ednsflags, GREASE_NSID_INFO);
 		}
 	}
@@ -8415,19 +8415,35 @@ rctx_edns(respctx_t *rctx) {
 	{
 		uint8_t version = (rctx->opt->ttl >> 16) & 0xff;
 
+		/*
+		 * Some nameservers fail to return the question section
+		 * when returning BADVERS
+		 */
+		if (query->rmessage->counts[DNS_SECTION_QUESTION] == 0 &&
+		    query->rmessage->rcode == dns_rcode_badvers)
+		{
+			log_grease(fctx, "grease-edns-negotiation",
+				   "EDNS version negotiation: question count"
+				   " is zero" GREASE_NSID_FMT,
+				   GREASE_NSID_INFO);
+			rctx->force_edns_0 = true;
+		}
+
 		/*
 		 * We expect the rcode to be BADVERS because we sent EDNS
 		 * version 100.
 		 */
 		if (query->rmessage->rcode != dns_rcode_badvers) {
+			char code[64];
+			isc_buffer_t b;
+			isc_buffer_init(&b, code, sizeof(code) - 1);
+			dns_rcode_totext(query->rmessage->rcode, &b);
+			code[isc_buffer_usedlength(&b)] = '\0';
 			log_grease(fctx, "grease-edns-negotiation",
-				   "EDNS version negotiation: rcode != "
-				   "BADVERS(16): %u" GREASE_NSID_FMT,
-				   query->rmessage->rcode, GREASE_NSID_INFO);
-			if (query->rmessage->rcode != dns_rcode_nxdomain &&
-			    query->rmessage->rcode != dns_rcode_noerror) {
-				rctx->force_edns_0 = true;
-			}
+				   "EDNS version negotiation: unexpected "
+				   "rcode: %s" GREASE_NSID_FMT,
+				   code, GREASE_NSID_INFO);
+			rctx->force_edns_0 = true;
 		}
 
 		/*