diff --git a/lib/dns/include/dns/tsig.h b/lib/dns/include/dns/tsig.h
index 1aeaa3461b..c4d4f2f0a8 100644
--- a/lib/dns/include/dns/tsig.h
+++ b/lib/dns/include/dns/tsig.h
@@ -86,13 +86,21 @@ struct dns_tsigkey {
 	ISC_LINK(dns_tsigkey_t) link;
 };
 
-#define dns_tsigkey_identity(tsigkey) \
-	((tsigkey) == NULL ? NULL : \
-	 (tsigkey)->generated ? ((tsigkey)->creator) : \
-	 (&((tsigkey)->name)))
-
 ISC_LANG_BEGINDECLS
 
+const dns_name_t *
+dns_tsigkey_identity(const dns_tsigkey_t *tsigkey);
+/*%<
+ *	Returns the identity of the provided TSIG key.
+ *
+ *	Requires:
+ *\li		'tsigkey' is a valid TSIG key or NULL
+ *
+ *	Returns:
+ *\li		NULL if 'tsigkey' was NULL
+ *\li		identity of the provided TSIG key
+ */
+
 isc_result_t
 dns_tsigkey_create(const dns_name_t *name, const dns_name_t *algorithm,
 		   unsigned char *secret, int length, bool generated,
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index a350178648..fd5f61d063 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -643,6 +643,20 @@ dns_tsigkeyring_dumpanddetach(dns_tsig_keyring_t **ringp, FILE *fp) {
 	return (result);
 }
 
+const dns_name_t *
+dns_tsigkey_identity(const dns_tsigkey_t *tsigkey) {
+	REQUIRE(tsigkey == NULL || VALID_TSIG_KEY(tsigkey));
+
+	if (tsigkey == NULL) {
+		return (NULL);
+	}
+	if (tsigkey->generated) {
+		return (tsigkey->creator);
+	} else {
+		return (&tsigkey->name);
+	}
+}
+
 isc_result_t
 dns_tsigkey_create(const dns_name_t *name, const dns_name_t *algorithm,
 		   unsigned char *secret, int length, bool generated,
diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
index 44092edcef..a3c7a90af5 100644
--- a/lib/dns/win32/libdns.def.in
+++ b/lib/dns/win32/libdns.def.in
@@ -1021,6 +1021,7 @@ dns_tsigkey_create
 dns_tsigkey_createfromkey
 dns_tsigkey_detach
 dns_tsigkey_find
+dns_tsigkey_identity
 dns_tsigkey_setdeleted
 dns_tsigkeyring_add
 dns_tsigkeyring_attach