diff --git a/lib/layer/iterate.c b/lib/layer/iterate.c
index 5ab6887c30f909eba8ffa8a0167eb1a768519fce..631f19e0e2be710381f367f4faec02040daed894 100644
--- a/lib/layer/iterate.c
+++ b/lib/layer/iterate.c
@@ -274,7 +274,7 @@ static int process_authority(knot_pkt_t *pkt, struct kr_request *req)
 			/* SOA below cut in authority indicates different authority, but same NS set. */
 			if (knot_dname_is_sub(rr->owner, qry->zone_cut.name)) {
 				qry->zone_cut.name = knot_dname_copy(rr->owner, &req->pool);
-				if (knot_pkt_has_dnssec(pkt)) { /* Treat as a referral */
+				if (qry->flags & QUERY_DNSSEC_WANT) { /* Treat as a referral */
 					return KNOT_STATE_DONE;
 				}
 			}
diff --git a/lib/layer/pktcache.c b/lib/layer/pktcache.c
index c4a50d0797a4a80c1ca2dbd052f6deb0f9484c9f..8c866e4ec3cd9679a5b0aabdfb07f770f9265f71 100644
--- a/lib/layer/pktcache.c
+++ b/lib/layer/pktcache.c
@@ -100,8 +100,8 @@ static int peek(knot_layer_t *ctx, knot_pkt_t *pkt)
 	if (!qry || ctx->state & (KNOT_STATE_DONE|KNOT_STATE_FAIL)) {
 		return ctx->state; /* Already resolved/failed */
 	}
-	if (!(qry->flags & QUERY_AWAIT_CUT)) {
-		return ctx->state; /* Only lookup on first iteration */
+	if (qry->ns.addr.ip.sa_family != AF_UNSPEC) {
+		return ctx->state; /* Only lookup before asking a query */
 	}
 	if (knot_pkt_qclass(pkt) != KNOT_CLASS_IN) {
 		return ctx->state; /* Only IN class */
diff --git a/lib/layer/validate.c b/lib/layer/validate.c
index 201ec0ed9b674fdfdd76816e94c1394f4efeaa7f..f6d08351ed173150f4fc3dbf5e0a02021273fc08 100644
--- a/lib/layer/validate.c
+++ b/lib/layer/validate.c
@@ -395,6 +395,7 @@ static int validate(knot_layer_t *ctx, knot_pkt_t *pkt)
 	const knot_dname_t *sig_name = first_rrsig_signer_name(pkt);
 	if (key_own && sig_name && !knot_dname_is_equal(key_own, sig_name)) {
 		DEBUG_MSG(qry, ">< cut changed, needs revalidation\n");
+		knot_wire_set_rcode(pkt->wire, KNOT_RCODE_SERVFAIL); /* Prevent caching */
 		qry->flags &= ~QUERY_RESOLVED;
 		return KNOT_STATE_CONSUME;
 	}