diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h
index 2488afed05..c900605670 100644
--- a/lib/dns/include/dns/result.h
+++ b/lib/dns/include/dns/result.h
@@ -85,8 +85,10 @@ typedef isc_result_t dns_result_t;	/* XXXRTH for legacy use only */
 #define DNS_R_BADZONE			(ISC_RESULTCLASS_DNS + 35) /* XXX MPA*/
 #define DNS_R_MOREDATA			(ISC_RESULTCLASS_DNS + 36)
 #define DNS_R_UPTODATE			(ISC_RESULTCLASS_DNS + 37)
+#define DNS_R_TSIGVERIFYFAILURE		(ISC_RESULTCLASS_DNS + 38)
+#define DNS_R_TSIGERRORSET		(ISC_RESULTCLASS_DNS + 39)
 
-#define DNS_R_NRESULTS			38	/* Number of results */
+#define DNS_R_NRESULTS			40	/* Number of results */
 
 /*
  * DNS wire format rcodes
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 847f236bc8..b949feb4bf 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -65,6 +65,8 @@ static char *text[DNS_R_NRESULTS] = {
 	"bad zone",				/* 35 */
 	"more data",				/* 36 */
 	"up to date",				/* 37 */
+	"tsig verify failure",			/* 38 */
+	"tsig error set in query",		/* 39 */
 };
 
 static char *rcode_text[DNS_R_NRCODERESULTS] = {
@@ -162,11 +164,15 @@ dns_result_torcode(isc_result_t result) {
 	case DNS_R_BADTTL:
 	case DNS_R_NOREDATA:
 	case DNS_R_BADZONE:
+	case DNS_R_TSIGERRORSET:
 		rcode = dns_rcode_formerr;
 		break;
 	case DNS_R_DISALLOWED:
 		rcode = dns_rcode_refused;
 		break;
+	case DNS_R_TSIGVERIFYFAILURE:
+		rcode = dns_rcode_notauth;
+		break;
 	default:
 		rcode = dns_rcode_servfail;
 	}