diff --git a/CHANGES b/CHANGES
index b9bcbb16ad..98589ff045 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3567.	[bug]		Silence clang static analyzer warnings. [RT #33365]
+
 3563.	[contrib]	zone2sqlite failed with some table names. [RT #33375]
 
 3561.	[bug]		dig: issue a warning if an EDNS query returns FORMERR
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index e3dcfdf982..3d22f997cc 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -526,6 +526,7 @@ main(int argc, char **argv) {
 					"recommended.\nIf you still wish to "
 					"use RSA (RSAMD5) please specify "
 					"\"-a RSAMD5\"\n");
+			INSIST(freeit == NULL);
 			return (1);
 		} else if (strcasecmp(algname, "HMAC-MD5") == 0)
 			alg = DST_ALG_HMACMD5;
diff --git a/bin/named/server.c b/bin/named/server.c
index d0ae6f7a81..05c68b992e 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -5984,6 +5984,7 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep,
 	dns_rdataclass_t rdclass;
 
 	REQUIRE(zonep != NULL && *zonep == NULL);
+	REQUIRE(zonename == NULL || *zonename == NULL);
 
 	input = args;
 
@@ -5996,7 +5997,7 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep,
 	zonetxt = next_token(&input, " \t");
 	if (zonetxt == NULL)
 		return (ISC_R_SUCCESS);
-	if (zonename)
+	if (zonename != NULL)
 		*zonename = zonetxt;
 
 	/* Look for the optional class name. */
@@ -7657,8 +7658,8 @@ ns_server_del_zone(ns_server_t *server, char *args) {
 		goto cleanup;
 	}
 
-	if (zonename != NULL)
-		znamelen = strlen(zonename);
+	INSIST(zonename != NULL);
+	znamelen = strlen(zonename);
 
 	/* Dig out configuration for this zone */
 	view = dns_zone_getview(zone);
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 5f63161f49..c212bf6849 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2235,6 +2235,10 @@ isspf(const dns_rdata_t *rdata) {
 		data += tl;
 		rdl -= tl;
 	}
+
+	if (i < 6U)
+		return(ISC_FALSE);
+
 	buf[i] = 0;
 	if (strncmp(buf, "v=spf1", 6) == 0 && (buf[6] == 0 || buf[6] == ' '))
 		return (ISC_TRUE);