diff --git a/src/libdnssec/key/dnskey.c b/src/libdnssec/key/dnskey.c
index 6360700acbfa68d6a0e77511ef54500d30e16479..9a3a665e1670288c722b16a2e12fc409046fd77e 100644
--- a/src/libdnssec/key/dnskey.c
+++ b/src/libdnssec/key/dnskey.c
@@ -64,7 +64,7 @@ int dnskey_rdata_to_crypto_key(const dnssec_binary_t *rdata, gnutls_pubkey_t *ke
 	flags_hi = wire_ctx_read_u8(&wire);
 	wire_ctx_set_offset(&wire, DNSKEY_RDATA_OFFSET_PROTOCOL);
 	protocol = wire_ctx_read_u8(&wire);
-	if (flags_hi != 0x1 || protocol != 0x3) {
+	if (!(flags_hi & 0x1) || protocol != 0x3) {
 		return DNSSEC_INVALID_PUBLIC_KEY;
 	}