diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index f7a8f87bd3..df9ac5e633 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -182,6 +182,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 	isc_result_t result;
 	int match_num = -1;
 	unsigned int i;
+	INSIST(DNS_ACL_VALID(acl));
 
 	REQUIRE(reqaddr != NULL);
 	REQUIRE(matchelt == NULL || *matchelt == NULL);