diff --git a/src/knot/nameserver/update.c b/src/knot/nameserver/update.c
index 8bc0c3bd21ad4047c096678f5990d0b06e948a7f..33ef6901e4fb58b754dbc75392e4e0824f3ab836 100644
--- a/src/knot/nameserver/update.c
+++ b/src/knot/nameserver/update.c
@@ -137,6 +137,7 @@ static int process_authenticated(uint16_t *rcode, struct query_data *qdata)
 
 	int ret = ddns_process_prereqs(query, zone->contents, rcode);
 	if (ret != KNOT_EOK) {
+		assert(*rcode != KNOT_RCODE_NOERROR);
 		return ret;
 	}
 
@@ -149,9 +150,11 @@ static int process_authenticated(uint16_t *rcode, struct query_data *qdata)
 	changeset_t *ddns_ch = changesets_get_last(ddns_chs);
 	ret = ddns_process_update(zone, query, ddns_ch, rcode);
 	if (ret != KNOT_EOK) {
+		assert(*rcode != KNOT_RCODE_NOERROR);
 		changesets_free(&ddns_chs, NULL);
 		return ret;
 	}
+	assert(*rcode == KNOT_RCODE_NOERROR);
 
 	zone_contents_t *new_contents = NULL;
 	const bool change_made = !changeset_is_empty(ddns_ch);
@@ -227,6 +230,7 @@ int update_process_query(knot_pkt_t *pkt, struct query_data *qdata)
 	uint16_t rcode = KNOT_RCODE_NOERROR;
 	int ret = process_authenticated(&rcode, qdata);
 	if (ret != KNOT_EOK) {
+		assert(rcode != KNOT_RCODE_NOERROR);
 		UPDATE_LOG(LOG_ERR, "%s", knot_strerror(ret));
 		knot_wire_set_rcode(pkt->wire, rcode);
 		return ret;
@@ -235,6 +239,7 @@ int update_process_query(knot_pkt_t *pkt, struct query_data *qdata)
 	/* Evaluate response. */
 	const uint32_t new_serial = zone_contents_serial(zone->contents);
 	if (new_serial == old_serial) {
+		assert(rcode == KNOT_RCODE_NOERROR);
 		UPDATE_LOG(LOG_NOTICE, "No change to zone made.");
 		return KNOT_EOK;
 	}
diff --git a/src/knot/updates/ddns.c b/src/knot/updates/ddns.c
index ed019c46cc553b6a9fa1b1fc92c09d40588771e9..ebfa00030f2c07b72f886c36c306978d2734e413 100644
--- a/src/knot/updates/ddns.c
+++ b/src/knot/updates/ddns.c
@@ -215,6 +215,7 @@ static int process_prereq(const knot_rrset_t *rrset, uint16_t qclass,
                           list_t *rrset_list)
 {
 	if (knot_rdata_ttl(knot_rdataset_at(&rrset->rrs, 0)) != 0) {
+		*rcode = KNOT_RCODE_FORMERR;
 		return KNOT_EMALF;
 	}
 
@@ -225,6 +226,7 @@ static int process_prereq(const knot_rrset_t *rrset, uint16_t qclass,
 
 	if (rrset->rclass == KNOT_CLASS_ANY) {
 		if (!rrset_empty(rrset)) {
+			*rcode = KNOT_RCODE_FORMERR;
 			return KNOT_EMALF;
 		}
 		if (rrset->type == KNOT_RRTYPE_ANY) {
@@ -234,6 +236,7 @@ static int process_prereq(const knot_rrset_t *rrset, uint16_t qclass,
 		}
 	} else if (rrset->rclass == KNOT_CLASS_NONE) {
 		if (!rrset_empty(rrset)) {
+			*rcode = KNOT_RCODE_FORMERR;
 			return KNOT_EMALF;
 		}
 		if (rrset->type == KNOT_RRTYPE_ANY) {
@@ -243,8 +246,13 @@ static int process_prereq(const knot_rrset_t *rrset, uint16_t qclass,
 		}
 	} else if (rrset->rclass == qclass) {
 		// Store RRs for full check into list
-		return add_rr_to_list(rrset_list, rrset);
+		int ret = add_rr_to_list(rrset_list, rrset);
+		if (ret != KNOT_EOK) {
+			*rcode = KNOT_RCODE_SERVFAIL;
+		}
+		return ret;
 	} else {
+		*rcode = KNOT_RCODE_FORMERR;
 		return KNOT_EMALF;
 	}
 }
@@ -966,12 +974,14 @@ int ddns_process_update(const zone_t *zone, const knot_pkt_t *query,
                         changeset_t *changeset, uint16_t *rcode)
 {
 	if (zone == NULL || query == NULL || changeset == NULL || rcode == NULL) {
+		*rcode = ret_to_rcode(KNOT_EINVAL);
 		return KNOT_EINVAL;
 	}
 
 	/* Copy base SOA RR. */
 	knot_rrset_t *soa_begin = node_create_rrset(zone->contents->apex, KNOT_RRTYPE_SOA);
 	if (soa_begin == NULL) {
+		*rcode = ret_to_rcode(KNOT_ENOMEM);
 		return KNOT_ENOMEM;
 	}
 
@@ -989,6 +999,7 @@ int ddns_process_update(const zone_t *zone, const knot_pkt_t *query,
 		/* Check if the entry is correct. */
 		int ret = check_update(rr, query, rcode);
 		if (ret != KNOT_EOK) {
+			assert(*rcode != KNOT_RCODE_NOERROR);
 			return ret;
 		}
 
@@ -1006,13 +1017,14 @@ int ddns_process_update(const zone_t *zone, const knot_pkt_t *query,
 	if (changeset->soa_to == NULL) {
 		// No SOA in the update, create according to current policy
 		if (changeset_is_empty(changeset)) {
+			*rcode = KNOT_RCODE_NOERROR;
 			// No change, no new SOA
 			return KNOT_EOK;
 		}
 
 		knot_rrset_t *soa_cpy = knot_rrset_copy(soa_begin, NULL);
 		if (soa_cpy == NULL) {
-			*rcode = KNOT_RCODE_SERVFAIL;
+			*rcode = ret_to_rcode(KNOT_ENOMEM);
 			return KNOT_ENOMEM;
 		}
 
@@ -1023,5 +1035,6 @@ int ddns_process_update(const zone_t *zone, const knot_pkt_t *query,
 		changeset_add_soa(changeset, soa_cpy, CHANGESET_ADD);
 	}
 
+	*rcode = KNOT_RCODE_NOERROR;
 	return KNOT_EOK;
 }