diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index f36f087fd0..237ddc0515 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -471,12 +471,20 @@ dst_key_isexternal(dst_key_t *key) {
 
 void
 dst_key_setmodified(dst_key_t *key, bool value) {
+	isc_mutex_lock(&key->mdlock);
 	key->modified = value;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 bool
-dst_key_ismodified(dst_key_t *key) {
-	return (key->modified);
+dst_key_ismodified(const dst_key_t *key) {
+	bool modified;
+
+	isc_mutex_lock(&(((dst_key_t *)key)->mdlock));
+	modified = key->modified;
+	isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
+
+	return (modified);
 }
 
 isc_result_t
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index 8fe32ab15c..fdd2122b20 100644
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -1118,7 +1118,7 @@ dst_key_setmodified(dst_key_t *key, bool value);
  */
 
 bool
-dst_key_ismodified(dst_key_t *key);
+dst_key_ismodified(const dst_key_t *key);
 /*%<
  * Check if the key file has been modified.
  *