diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 87abec4e70..e5f1860c25 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -287,6 +287,10 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 	/*
 	 * Publish successor 'prepub' time before the 'retire' time of 'key'.
 	 */
+	if (prepub > retire) {
+		/* We should have already prepublished the new key. */
+		return (now);
+	}
 	return (retire - prepub);
 }