diff --git a/lib/dns/master.c b/lib/dns/master.c
index e6b1a0a803..a2eef3f2fd 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -2375,7 +2375,7 @@ load_raw(dns_loadctx_t *lctx) {
 		rdatalist.covers = isc_buffer_getuint16(&target);
 		rdatalist.ttl =  isc_buffer_getuint32(&target);
 		rdcount = isc_buffer_getuint32(&target);
-		if (rdcount == 0) {
+		if (rdcount == 0 || rdcount > 0xffff) {
 			result = ISC_R_RANGE;
 			goto cleanup;
 		}