diff --git a/lib/layer/rrcache.c b/lib/layer/rrcache.c
index 8c33b4f84d4fcb1b3fb7dbe803540c9c57ede7e3..7226bfc5102e1b99f8797e311c5fa7e89fb247e8 100644
--- a/lib/layer/rrcache.c
+++ b/lib/layer/rrcache.c
@@ -91,8 +91,9 @@ static int loot_rrcache(struct kr_cache *cache, knot_pkt_t *pkt, struct kr_query
 		rrtype = KNOT_RRTYPE_CNAME;
 		ret = loot_rr(&txn, pkt, qry->sname, qry->sclass, rrtype, qry, &rank, 0);
 	}
-	/* Record isn't flagged as INSECURE => doesn't have RRSIG. */
+	/* Record is flagged as INSECURE => doesn't have RRSIG. */
 	if (ret == 0 && (rank & KR_RANK_INSECURE)) {
+		qry->flags |= QUERY_DNSSEC_INSECURE;
 		qry->flags &= ~QUERY_DNSSEC_WANT;
 	/* Record may have RRSIG, try to find it. */
 	} else if (ret == 0 && dobit) {
diff --git a/lib/resolve.c b/lib/resolve.c
index 9d33847ccd5bcdfca83eba27b0ecd57d1b9b9584..6e27de2935bd4d617d5b1a987b059cdf88ef5503 100644
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -325,8 +325,8 @@ static int answer_finalize(struct kr_request *request, int state)
 	if (state == KNOT_STATE_DONE && rplan->resolved.len > 0) {
 		struct kr_query *last = array_tail(rplan->resolved);
 		/* Do not set AD for RRSIG query, as we can't validate it. */
-		if ((last->flags & QUERY_DNSSEC_WANT) && knot_pkt_has_dnssec(answer) &&
-			knot_pkt_qtype(answer) != KNOT_RRTYPE_RRSIG) {
+		const bool dnssec_ok = (last->flags & QUERY_DNSSEC_WANT) && !(last->flags & QUERY_DNSSEC_INSECURE);
+		if (dnssec_ok && knot_pkt_qtype(answer) != KNOT_RRTYPE_RRSIG) {
 			knot_wire_set_ad(answer->wire);
 		}
 	}
@@ -393,7 +393,7 @@ static int resolve_query(struct kr_request *request, const knot_pkt_t *packet)
 	/* Want DNSSEC if it's posible to secure this name (e.g. is covered by any TA) */
 	map_t *negative_anchors = &request->ctx->negative_anchors;
 	map_t *trust_anchors = &request->ctx->trust_anchors;
-	if (knot_pkt_has_dnssec(packet) &&
+	if ((knot_wire_get_ad(packet->wire) || knot_pkt_has_dnssec(packet)) &&
 	    kr_ta_covers(trust_anchors, qname) && !kr_ta_covers(negative_anchors, qname)) {
 		qry->flags |= QUERY_DNSSEC_WANT;
 	}