diff --git a/src/knot/nameserver/tsig_ctx.c b/src/knot/nameserver/tsig_ctx.c
index d1719307b88e5d63874e94314340a1b014efcb77..233eb00f78424a66f8280433289fddaeee99d5b4 100644
--- a/src/knot/nameserver/tsig_ctx.c
+++ b/src/knot/nameserver/tsig_ctx.c
@@ -44,6 +44,16 @@ void tsig_cleanup(tsig_ctx_t *ctx)
 	memset(ctx, 0, sizeof(*ctx));
 }
 
+void tsig_reset(tsig_ctx_t *ctx)
+{
+	if (!ctx) {
+		return;
+	}
+
+	const knot_tsig_key_t *backup = ctx->key;
+	tsig_init(ctx, backup);
+}
+
 int tsig_sign_packet(tsig_ctx_t *ctx, knot_pkt_t *packet)
 {
 	if (!ctx || !packet) {
diff --git a/src/knot/nameserver/tsig_ctx.h b/src/knot/nameserver/tsig_ctx.h
index eb24a633858288eecb6c7ec6f03dd5aaca526c56..256ada36de689847650a60b05b52edaf4c1682ac 100644
--- a/src/knot/nameserver/tsig_ctx.h
+++ b/src/knot/nameserver/tsig_ctx.h
@@ -56,6 +56,11 @@ void tsig_init(tsig_ctx_t *ctx, const knot_tsig_key_t *key);
  */
 void tsig_cleanup(tsig_ctx_t *ctx);
 
+/*!
+ * \brief Reset TSIG context for new message exchange.
+ */
+void tsig_reset(tsig_ctx_t *ctx);
+
 /*!
  * \brief Sign outgoing packet.
  *