diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index a207da8b79..e038e220a1 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -2033,6 +2033,8 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 	dns_dnsseckey_t *key;
 
 	REQUIRE(digests != NULL);
+	REQUIRE(keys != NULL);
+	REQUIRE(rmkeys != NULL);
 
 	for (key = ISC_LIST_HEAD(*keys); key != NULL;
 	     key = ISC_LIST_NEXT(key, link))
diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
index 17280fe570..1e9e576564 100644
--- a/lib/dns/include/dns/dnssec.h
+++ b/lib/dns/include/dns/dnssec.h
@@ -371,6 +371,8 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
  * Any changes made also cause a dns_difftuple to be added to 'diff'.
  *
  * Requires:
+ *\li	'keys' is not NULL.
+ *\li	'rmkeys' is not NULL.
  *\li	'digests' is not NULL.
  *
  * Returns: