diff --git a/CHANGES b/CHANGES
index b43cbe70ac..abf205db98 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@
 
 1452.	[bug]		Bad #ifdef, ISC_RFC2335 -> ISC_RFC2535.
 
+1439.	[bug]		Named could return NOERROR with certain NOTIFY
+			failures.  Return NOTAUTH if the NOTIFY zone is
+			not being served.
+
 1435.	[bug]		zmgr_resume_xfrs() was being called read locked
 			rather than write locked.  zmgr_resume_xfrs()
 			was not being called if the zone was being
diff --git a/bin/named/notify.c b/bin/named/notify.c
index 6ac078e1c3..61b8921fa8 100644
--- a/bin/named/notify.c
+++ b/bin/named/notify.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: notify.c,v 1.24 2001/03/31 01:03:26 bwelling Exp $ */
+/* $Id: notify.c,v 1.24.2.1 2003/05/13 05:10:27 marka Exp $ */
 
 #include <config.h>
 
@@ -84,7 +84,7 @@ ns_notify_start(ns_client_t *client) {
 	result = dns_message_firstname(request, DNS_SECTION_QUESTION);
 	if (result != ISC_R_SUCCESS) {
 		notify_log(ISC_LOG_INFO, "notify question section empty");
-		goto failure;
+		goto formerr;
 	}
 
 	/*
@@ -96,7 +96,7 @@ ns_notify_start(ns_client_t *client) {
 	if (ISC_LIST_NEXT(zone_rdataset, link) != NULL) {
 		notify_log(ISC_LOG_INFO,
 			   "notify question section contains multiple RRs");
-		goto failure;
+		goto formerr;
 	}
 
 	/* The zone section must have exactly one name. */
@@ -111,36 +111,39 @@ ns_notify_start(ns_client_t *client) {
 	if (zone_rdataset->type != dns_rdatatype_soa) {
 		notify_log(ISC_LOG_INFO,
 			   "notify question section contains no SOA");
-		goto failure;
+		goto formerr;
 	}
 
+	dns_name_format(zonename, str, sizeof(str));
 	result = dns_zt_find(client->view->zonetable, zonename, 0, NULL,
 			     &zone);
-	if (result != ISC_R_SUCCESS) {
-		dns_name_format(zonename, str, sizeof(str));
-		notify_log(ISC_LOG_INFO,
-			   "received notify for zone '%s': not authoritative",
-			   str);
-		goto failure;
-	}
+	if (result != ISC_R_SUCCESS)
+		goto notauth;
 
 	switch(dns_zone_gettype(zone)) {
 	case dns_zone_master:
 	case dns_zone_slave:
 	case dns_zone_stub:	/* Allow dialup passive to work. */
+		notify_log(ISC_LOG_INFO, "received notify for zone '%s'", str);
 		respond(client, dns_zone_notifyreceive(zone,
 			ns_client_getsockaddr(client), request));
 		break;
 	default:
-		dns_name_format(zonename, str, sizeof(str));
-		notify_log(ISC_LOG_INFO,
-			   "received notify for zone '%s': not authoritative",
-			   str);
-		goto failure;
+		goto notauth;
 	}
 	dns_zone_detach(&zone);
 	return;
 
+ notauth:
+	notify_log(ISC_LOG_INFO,
+		   "received notify for zone '%s': not authoritative",
+		   str);
+	result = DNS_R_NOTAUTH;
+	goto failure;
+
+ formerr:
+	result = DNS_R_FORMERR;
+
  failure:
 	if (zone != NULL)
 		dns_zone_detach(&zone);