diff --git a/bin/dnssec/dnssec-dsfromkey.8 b/bin/dnssec/dnssec-dsfromkey.8
index 55621c05ae..619a2ca5de 100644
--- a/bin/dnssec/dnssec-dsfromkey.8
+++ b/bin/dnssec/dnssec-dsfromkey.8
@@ -98,7 +98,7 @@ Specify a digest algorithm to use when converting DNSKEY records to DS records\&
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is to use both SHA\-1 and SHA\-256\&.
 .RE
 .PP
 \-A
diff --git a/bin/dnssec/dnssec-dsfromkey.docbook b/bin/dnssec/dnssec-dsfromkey.docbook
index 7f0039ebb1..7fe0bf5add 100644
--- a/bin/dnssec/dnssec-dsfromkey.docbook
+++ b/bin/dnssec/dnssec-dsfromkey.docbook
@@ -177,7 +177,7 @@
 	    The <replaceable>algorithm</replaceable> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
-	    the default is SHA-256.
+	    the default is to use both SHA-1 and SHA-256.
 	  </para>
 	</listitem>
       </varlistentry>
diff --git a/bin/dnssec/dnssec-dsfromkey.html b/bin/dnssec/dnssec-dsfromkey.html
index ee1cfea9e6..1b99200ff3 100644
--- a/bin/dnssec/dnssec-dsfromkey.html
+++ b/bin/dnssec/dnssec-dsfromkey.html
@@ -156,7 +156,7 @@
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
-	    the default is SHA-256.
+	    the default is to use both SHA-1 and SHA-256.
 	  </p>
 	</dd>
 <dt><span class="term">-A</span></dt>