diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index c01a640755..7239b5e4c7 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -272,7 +272,7 @@ strtokeystate(const char *str) {
 			return ((dst_key_state_t)i);
 		}
 	}
-	fatal("unknown key state");
+	fatal("unknown key state %s", str);
 }
 
 isc_stdtime_t