diff --git a/CHANGES b/CHANGES
index 27f08bd70c..bf9f0b8ffa 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2213.	[bug]		SIG0 diagnostic failure messages were looking at the
+			wrong status code. [RT #17101]
+
 2212.	[func]		'host -m' now causes memory statistics and active
 			memory to be printed at exit. [RT 17028]
 
diff --git a/bin/named/client.c b/bin/named/client.c
index dcb0406c64..de49512a85 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.248 2007/06/26 02:52:15 marka Exp $ */
+/* $Id: client.c,v 1.249 2007/08/22 00:42:42 marka Exp $ */
 
 #include <config.h>
 
@@ -1674,16 +1674,19 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		char tsigrcode[64];
 		isc_buffer_t b;
 		dns_name_t *name = NULL;
+		dns_rcode_t status;
+		isc_result_t tresult;
 
-		isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
-		RUNTIME_CHECK(dns_tsigrcode_totext(client->message->tsigstatus,
-						   &b) == ISC_R_SUCCESS);
-		tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 		/* There is a signature, but it is bad. */
 		if (dns_message_gettsig(client->message, &name) != NULL) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			char cnamebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(name, namebuf, sizeof(namebuf));
+			status = client->message->tsigstatus;
+			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
+			tresult = dns_tsigrcode_totext(status, &b);
+			INSIST(tresult == ISC_R_SUCCESS);
+			tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 			if (client->message->tsigkey->generated) {
 				dns_name_format(client->message->tsigkey->creator,
 						cnamebuf, sizeof(cnamebuf));
@@ -1705,6 +1708,11 @@ client_request(isc_task_t *task, isc_event_t *event) {
 					      tsigrcode);
 			}
 		} else {
+			status = client->message->sig0status;
+			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
+			tresult = dns_tsigrcode_totext(status, &b);
+			INSIST(tresult == ISC_R_SUCCESS);
+			tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 				      NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
 				      "request has invalid signature: %s (%s)",