diff --git a/bin/tests/system/smartsign/tests.sh b/bin/tests/system/smartsign/tests.sh
index 59aa0b17f0..534aa117a9 100644
--- a/bin/tests/system/smartsign/tests.sh
+++ b/bin/tests/system/smartsign/tests.sh
@@ -55,6 +55,9 @@ cksk4=`$REVOKE $cksk3`
 echo_i "setting up sync key"
 cksk5=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now $czone`
 
+echo_i "and future sync key"
+cksk6=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now+1mo $czone`
+
 echo_i "generating parent keys"
 pzsk=`$KEYGEN -q -a rsasha1 $pzone`
 pksk=`$KEYGEN -q -a rsasha1 -fk $pzone`
@@ -348,6 +351,7 @@ awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+# this also checks that the future sync record is not yet published
 echo_i "checking sync record deletion"
 ret=0
 $SETTIME -P now -A now -Dsync now ${cksk5} > /dev/null
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index df8d8e7c41..f448113193 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -648,6 +648,7 @@ syncpublish(dst_key_t *key, isc_stdtime_t now) {
 	isc_stdtime_t when;
 	dst_key_state_t state;
 	int major, minor;
+	bool publish;
 
 	/*
 	 * Is this an old-style key?
@@ -670,18 +671,16 @@ syncpublish(dst_key_t *key, isc_stdtime_t now) {
 	}
 
 	/* If no kasp state, check timings. */
+	publish = false;
 	result = dst_key_gettime(key, DST_TIME_SYNCPUBLISH, &when);
-	if (result != ISC_R_SUCCESS) {
-		return (false);
+	if (result == ISC_R_SUCCESS && when < now) {
+		publish = true;
 	}
 	result = dst_key_gettime(key, DST_TIME_SYNCDELETE, &when);
-	if (result != ISC_R_SUCCESS) {
-		return (true);
+	if (result == ISC_R_SUCCESS && when < now) {
+		publish = false;
 	}
-	if (when <= now) {
-		return (false);
-	}
-	return (true);
+	return (publish);
 }
 
 /*%<