diff --git a/CHANGES b/CHANGES
index 590e19799a..adb3c7f22f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4365.	[bug]		Address zone reference counting errors involving
+			nxdomain-redirect. [RT #42258]
+
 4364.	[port]		freebsd: add -Wl,-E to loader flags [RT #41690]
 
 4363.	[port]		Turn off triggering UAC when running BINDInstall
diff --git a/bin/named/query.c b/bin/named/query.c
index 07d3a3e491..faa39d6354 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -6384,6 +6384,8 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 			     &db, &version, &is_zonep);
 	if (result != ISC_R_SUCCESS)
 		return (ISC_R_NOTFOUND);
+	if (zone != NULL)
+		dns_zone_detach(&zone);
 
 	/*
 	 * Lookup the requested data in the redirect zone.
@@ -7966,6 +7968,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			client->query.redirect.authoritative = authoritative;
 			db = NULL;
 			node = NULL;
+			zone = NULL;
 			rdataset = NULL;
 			sigrdataset = NULL;
 			goto cleanup;