diff --git a/lib/dns/keytable.c b/lib/dns/keytable.c
index bd83ed8f19..3514026377 100644
--- a/lib/dns/keytable.c
+++ b/lib/dns/keytable.c
@@ -677,10 +677,12 @@ keynode_dslist_totext(dns_name_t *name, dns_keynode_t *keynode,
 
 		dns_secalg_format(ds.algorithm, algbuf, sizeof(algbuf));
 
+		RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
 		snprintf(obuf, sizeof(obuf), "%s/%s/%d ; %s%s\n", namebuf,
 			 algbuf, ds.key_tag,
 			 keynode->initial ? "initializing " : "",
 			 keynode->managed ? "managed" : "static");
+		RWUNLOCK(&keynode->rwlock, isc_rwlocktype_read);
 
 		result = putstr(text, obuf);
 		if (result != ISC_R_SUCCESS) {
@@ -802,38 +804,56 @@ cleanup:
 
 bool
 dns_keynode_dsset(dns_keynode_t *keynode, dns_rdataset_t *rdataset) {
+	bool result;
 	REQUIRE(VALID_KEYNODE(keynode));
 	REQUIRE(rdataset == NULL || DNS_RDATASET_VALID(rdataset));
 
+	RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
 	if (keynode->dslist != NULL) {
 		if (rdataset != NULL) {
 			keynode_clone(&keynode->dsset, rdataset);
 		}
-		return (true);
+		result = true;
+	} else {
+		result = false;
 	}
-
-	return (false);
+	RWUNLOCK(&keynode->rwlock, isc_rwlocktype_read);
+	return (result);
 }
 
 bool
 dns_keynode_managed(dns_keynode_t *keynode) {
+	bool managed;
+
 	REQUIRE(VALID_KEYNODE(keynode));
 
-	return (keynode->managed);
+	RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
+	managed = keynode->managed;
+	RWUNLOCK(&keynode->rwlock, isc_rwlocktype_read);
+
+	return (managed);
 }
 
 bool
 dns_keynode_initial(dns_keynode_t *keynode) {
+	bool initial;
+
 	REQUIRE(VALID_KEYNODE(keynode));
 
-	return (keynode->initial);
+	RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
+	initial = keynode->initial;
+	RWUNLOCK(&keynode->rwlock, isc_rwlocktype_read);
+
+	return (initial);
 }
 
 void
 dns_keynode_trust(dns_keynode_t *keynode) {
 	REQUIRE(VALID_KEYNODE(keynode));
 
+	RWLOCK(&keynode->rwlock, isc_rwlocktype_write);
 	keynode->initial = false;
+	RWUNLOCK(&keynode->rwlock, isc_rwlocktype_write);
 }
 
 static void