diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 2e0d5e893c..c1809d7dd5 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -3894,7 +3894,8 @@ main(int argc, char *argv[]) {
 		bool answer;
 
 		hash_length = dns_nsec3_hashlength(dns_hash_sha1);
-		hashlist_init(&hashlist, dns_db_nodecount(gdb) * 2,
+		hashlist_init(&hashlist,
+			      dns_db_nodecount(gdb, dns_dbtree_main) * 2,
 			      hash_length);
 		result = dns_nsec_nseconly(gdb, gversion, &answer);
 		if (result == ISC_R_NOTFOUND) {
diff --git a/bin/named/server.c b/bin/named/server.c
index b2d4718622..ac8bc553a2 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15367,7 +15367,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	}
 
 	/* Database node count */
-	nodes = dns_db_nodecount(hasraw ? rawdb : db);
+	nodes = dns_db_nodecount(hasraw ? rawdb : db, dns_dbtree_main);
 	snprintf(nodebuf, sizeof(nodebuf), "%u", nodes);
 
 	/* Security */
diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
index ab52f67a0c..9601c877c4 100644
--- a/bin/tests/system/dyndb/driver/db.c
+++ b/bin/tests/system/dyndb/driver/db.c
@@ -361,12 +361,12 @@ issecure(dns_db_t *db) {
 }
 
 static unsigned int
-nodecount(dns_db_t *db) {
+nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_nodecount(sampledb->rbtdb));
+	return (dns_db_nodecount(sampledb->rbtdb, tree));
 }
 
 /*
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index 41263bf256..74d7df61ef 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -1260,7 +1260,7 @@ dns_cache_dumpstats(dns_cache_t *cache, FILE *fp) {
 	fprintf(fp, "%20" PRIu64 " %s\n",
 		values[dns_cachestatscounter_deletettl],
 		"cache records deleted due to TTL expiration");
-	fprintf(fp, "%20u %s\n", dns_db_nodecount(cache->db),
+	fprintf(fp, "%20u %s\n", dns_db_nodecount(cache->db, dns_dbtree_main),
 		"cache database nodes");
 	fprintf(fp, "%20" PRIu64 " %s\n", (uint64_t)dns_db_hashsize(cache->db),
 		"cache database hash buckets");
@@ -1327,7 +1327,8 @@ dns_cache_renderxml(dns_cache_t *cache, void *writer0) {
 	TRY0(renderstat("DeleteTTL", values[dns_cachestatscounter_deletettl],
 			writer));
 
-	TRY0(renderstat("CacheNodes", dns_db_nodecount(cache->db), writer));
+	TRY0(renderstat("CacheNodes",
+			dns_db_nodecount(cache->db, dns_dbtree_main), writer));
 	TRY0(renderstat("CacheBuckets", dns_db_hashsize(cache->db), writer));
 
 	TRY0(renderstat("TreeMemTotal", isc_mem_total(cache->mctx), writer));
@@ -1388,7 +1389,8 @@ dns_cache_renderjson(dns_cache_t *cache, void *cstats0) {
 	CHECKMEM(obj);
 	json_object_object_add(cstats, "DeleteTTL", obj);
 
-	obj = json_object_new_int64(dns_db_nodecount(cache->db));
+	obj = json_object_new_int64(
+		dns_db_nodecount(cache->db, dns_dbtree_main));
 	CHECKMEM(obj);
 	json_object_object_add(cstats, "CacheNodes", obj);
 
diff --git a/lib/dns/db.c b/lib/dns/db.c
index b889d8f902..df9debc0f9 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -807,10 +807,10 @@ freenode:
 }
 
 unsigned int
-dns_db_nodecount(dns_db_t *db) {
+dns_db_nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	REQUIRE(DNS_DB_VALID(db));
 
-	return ((db->methods->nodecount)(db));
+	return ((db->methods->nodecount)(db, tree));
 }
 
 size_t
diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index 4ed5a12778..ae190b9a1b 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -134,7 +134,7 @@ typedef struct dns_dbmethods {
 				       dns_rdatatype_t	type,
 				       dns_rdatatype_t	covers);
 	bool (*issecure)(dns_db_t *db);
-	unsigned int (*nodecount)(dns_db_t *db);
+	unsigned int (*nodecount)(dns_db_t *db, dns_dbtree_t);
 	bool (*ispersistent)(dns_db_t *db);
 	void (*overmem)(dns_db_t *db, bool overmem);
 	void (*settask)(dns_db_t *db, isc_task_t *);
@@ -1349,9 +1349,9 @@ dns_db_overmem(dns_db_t *db, bool overmem);
  */
 
 unsigned int
-dns_db_nodecount(dns_db_t *db);
+dns_db_nodecount(dns_db_t *db, dns_dbtree_t tree);
 /*%<
- * Count the number of nodes in 'db'.
+ * Count the number of nodes in 'db' or its auxiliary trees.
  *
  * Requires:
  *
diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
index 9a617e1b7f..ee2e062b2c 100644
--- a/lib/dns/include/dns/types.h
+++ b/lib/dns/include/dns/types.h
@@ -179,6 +179,12 @@ typedef enum {
 	dns_dbtype_stub = 3
 } dns_dbtype_t;
 
+typedef enum {
+	dns_dbtree_main = 0,
+	dns_dbtree_nsec = 1,
+	dns_dbtree_nsec3 = 2
+} dns_dbtree_t;
+
 typedef enum {
 	dns_notifytype_no = 0,
 	dns_notifytype_yes = 1,
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 70893ee029..a7e2a654b1 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -7580,7 +7580,7 @@ isdnssec(dns_db_t *db) {
 }
 
 static unsigned int
-nodecount(dns_db_t *db) {
+nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	dns_rbtdb_t *rbtdb;
 	unsigned int count;
 
@@ -7589,7 +7589,20 @@ nodecount(dns_db_t *db) {
 	REQUIRE(VALID_RBTDB(rbtdb));
 
 	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	count = dns_rbt_nodecount(rbtdb->tree);
+	switch (tree) {
+	case dns_dbtree_main:
+		count = dns_rbt_nodecount(rbtdb->tree);
+		break;
+	case dns_dbtree_nsec:
+		count = dns_rbt_nodecount(rbtdb->nsec);
+		break;
+	case dns_dbtree_nsec3:
+		count = dns_rbt_nodecount(rbtdb->nsec3);
+		break;
+	default:
+		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
 
 	return (count);
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index ffca94bc7a..eeb4c8ae0a 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1705,7 +1705,7 @@ setup_update(dns_rpz_zone_t *rpz) {
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
 		      ISC_LOG_INFO, "rpz: %s: reload start", domain);
 
-	nodecount = dns_db_nodecount(rpz->updb);
+	nodecount = dns_db_nodecount(rpz->updb, dns_dbtree_main);
 	hashsize = 1;
 	while (nodecount != 0 &&
 	       hashsize <= (DNS_RPZ_HTSIZE_MAX + DNS_RPZ_HTSIZE_DIV)) {
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index 1fcb0f54da..aeadeba3fb 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -1237,8 +1237,9 @@ issecure(dns_db_t *db) {
 }
 
 static unsigned int
-nodecount(dns_db_t *db) {
+nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	UNUSED(db);
+	UNUSED(tree);
 
 	return (0);
 }
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index 5eea5cb6b9..72fd9ffc7f 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -1186,8 +1186,9 @@ issecure(dns_db_t *db) {
 }
 
 static unsigned int
-nodecount(dns_db_t *db) {
+nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	UNUSED(db);
+	UNUSED(tree);
 
 	return (0);
 }
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 92d23558c5..08112ac2b5 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -4884,7 +4884,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	}
 
 	dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD, ISC_LOG_DEBUG(2),
-		      "number of nodes in database: %u", dns_db_nodecount(db));
+		      "number of nodes in database: %u",
+		      dns_db_nodecount(db, dns_dbtree_main));
 
 	if (result == DNS_R_SEENINCLUDE) {
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HASINCLUDE);