diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 16afcc7b87..a28cd78a43 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -14150,6 +14150,10 @@ again:
 	curraddr = dns_remote_curraddr(&zone->primaries);
 	isc_netaddr_fromsockaddr(&primaryip, &curraddr);
 
+	if (isc_sockaddr_disabled(&curraddr)) {
+		goto skip_primary;
+	}
+
 	/*
 	 * First, look for a tsig key in the primaries statement, then
 	 * try for a server key.