diff --git a/ChangeLog b/ChangeLog
index 32de30915..5243876e8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,6 +19,9 @@
    - jakob@cvs.openbsd.org 2003/05/15 01:48:10
      [readconf.c readconf.h servconf.c servconf.h]
      always parse kerberos options. ok djm@ markus@
+   - jakob@cvs.openbsd.org 2003/05/15 02:27:15
+     [dns.c]
+     add missing freerrset
  - (djm) Always parse UsePAM
  - (djm) Configure glue for DNS support (code doesn't work in portable yet)
  - (djm) Import getrrsetbyname() function from OpenBSD libc (for DNS support)
@@ -1499,4 +1502,4 @@
      save auth method before monitor_reset_key_state(); bugzilla bug #284;
      ok provos@
 
-$Id: ChangeLog,v 1.2709 2003/05/15 03:23:36 djm Exp $
+$Id: ChangeLog,v 1.2710 2003/05/15 03:27:28 djm Exp $
diff --git a/dns.c b/dns.c
index 9b7a0e7a0..14ca13a48 100644
--- a/dns.c
+++ b/dns.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dns.c,v 1.4 2003/05/14 23:29:22 jakob Exp $	*/
+/*	$OpenBSD: dns.c,v 1.5 2003/05/15 02:27:15 jakob Exp $	*/
 
 /*
  * Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -44,7 +44,7 @@
 #include "uuencode.h"
 
 extern char *__progname;
-RCSID("$OpenBSD: dns.c,v 1.4 2003/05/14 23:29:22 jakob Exp $");
+RCSID("$OpenBSD: dns.c,v 1.5 2003/05/15 02:27:15 jakob Exp $");
 
 #ifndef LWRES
 static const char *errset_text[] = {
@@ -183,6 +183,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
 	/* Only accept validated answers */
 	if (!fingerprints->rri_flags & RRSET_VALIDATED) {
 		error("Ignored unvalidated fingerprint from DNS.");
+		freerrset(fingerprints);
 		return DNS_VERIFY_ERROR;
 	}
 #endif
@@ -193,6 +194,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
 	if (!dns_read_key(&hostkey_algorithm, &hostkey_digest_type,
 	    &hostkey_digest, &hostkey_digest_len, hostkey)) {
 		error("Error calculating host key fingerprint.");
+		freerrset(fingerprints);
 		return DNS_VERIFY_ERROR;
 	}