diff --git a/daemon/lua/kres.lua b/daemon/lua/kres.lua
index 784ecbc467be490e793f396956602e8d6b729a99..dd9dc07e0ae202b8d0f2a0369f41cba0fba74789 100644
--- a/daemon/lua/kres.lua
+++ b/daemon/lua/kres.lua
@@ -339,6 +339,12 @@ ffi.metatype( kr_query_t, {
 			assert(qry)
 			return C.kr_rplan_next(qry)
 		end,
+		resolved = function(qry)
+			return band(qry.flags, kres.query.RESOLVED) ~= 0
+		end,
+		final = function(qry)
+			return qry:resolved() and (qry.parent == nil)
+		end,
 	},
 })
 -- Metatype for request
diff --git a/modules/dns64/dns64.lua b/modules/dns64/dns64.lua
index 2a98b0997bc7308a2281ceefb1d47e3821685b8c..0dca4e23dd2d883c28807ce67d6070052cbc8b07 100644
--- a/modules/dns64/dns64.lua
+++ b/modules/dns64/dns64.lua
@@ -16,7 +16,7 @@ mod.layer = {
 		req = kres.request_t(req)
 		qry = req:current()
 		-- Observe only authoritative answers
-		if mod.proxy == nil or bit.band(qry.flags, kres.query.RESOLVED) == 0 then
+		if mod.proxy == nil or not qry:resolved() then
 			return state
 		end
 		-- Synthetic AAAA from marked A responses
@@ -36,7 +36,7 @@ mod.layer = {
 		end
 		-- Observe AAAA NODATA responses
 		local is_nodata = (pkt:rcode() == kres.rcode.NOERROR) and (#answer == 0)
-		if pkt:qtype() == kres.type.AAAA and is_nodata and pkt:qname() == qry:name() then
+		if pkt:qtype() == kres.type.AAAA and is_nodata and pkt:qname() == qry:name() and qry:final() then
 			local next = req:push(pkt:qname(), kres.type.A, kres.class.IN, 0, qry)
 			next.flags = bit.band(qry.flags, kres.query.DNSSEC_WANT) + kres.query.AWAIT_CUT + MARK_DNS64
 		end