diff --git a/CHANGES b/CHANGES
index c4d88d8522..daacb76a0e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 1588.	[bug]		win32: TCP sockets could become blocked. [RT #10115]
 
+1587.	[bug]		dns_message_settsigkey() failed to clear existing key.
+			[RT #10590]
+
 1585.	[bug]		allow-v6-synthesis was not performing lookups under
 			IP6.INT.  allow-v6-synthesis now performs a nibble
 			lookups under IP6.ARPA rather than a bitstring lookups.
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 094ed61c56..eb865e5e4d 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.c,v 1.194.2.12 2004/03/09 06:11:03 marka Exp $ */
+/* $Id: message.c,v 1.194.2.13 2004/03/10 00:50:02 marka Exp $ */
 
 /***
  *** Imports
@@ -2451,6 +2451,13 @@ dns_message_settsigkey(dns_message_t *msg, dns_tsigkey_t *key) {
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(msg->state == DNS_SECTION_ANY);
 
+	if (key == NULL && msg->tsigkey != NULL) {
+		if (msg->sig_reserved != 0) {
+			dns_message_renderrelease(msg, msg->sig_reserved);
+			msg->sig_reserved = 0;
+		}
+		dns_tsigkey_detach(&msg->tsigkey);
+	}
 	if (key != NULL) {
 		dns_tsigkey_attach(key, &msg->tsigkey);
 		if (msg->from_to_wire == DNS_MESSAGE_INTENTRENDER) {