diff --git a/lib/dns/sec/dst/dst_api.c b/lib/dns/sec/dst/dst_api.c
index 395cd5b41a..6010bd34eb 100644
--- a/lib/dns/sec/dst/dst_api.c
+++ b/lib/dns/sec/dst/dst_api.c
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.27 2000/04/12 15:52:11 bwelling Exp $
+ * $Id: dst_api.c,v 1.28 2000/04/18 17:39:36 bwelling Exp $
  */
 
 #include <config.h>
@@ -729,6 +729,20 @@ dst_key_iszonekey(const dst_key_t *key) {
 	return (ISC_TRUE);
 }
 
+isc_boolean_t
+dst_key_isnullkey(const dst_key_t *key) {
+	REQUIRE(VALID_KEY(key));
+      
+	if ((key->key_flags & DNS_KEYFLAG_TYPEMASK) != DNS_KEYTYPE_NOKEY)
+		return (ISC_FALSE);
+	if ((key->key_flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE)
+		return (ISC_FALSE);
+	if (key->key_proto != DNS_KEYPROTO_DNSSEC &&
+	    key->key_proto != DNS_KEYPROTO_ANY)
+		return (ISC_FALSE);
+	return (ISC_TRUE);
+}
+
 /*
  * dst_sig_size
  *	Computes the maximum size of a signature generated by the given key
diff --git a/lib/dns/sec/dst/include/dst/dst.h b/lib/dns/sec/dst/include/dst/dst.h
index c94ea1342c..3741618614 100644
--- a/lib/dns/sec/dst/include/dst/dst.h
+++ b/lib/dns/sec/dst/include/dst/dst.h
@@ -292,6 +292,9 @@ dst_key_isprivate(const dst_key_t *key);
 isc_boolean_t
 dst_key_iszonekey(const dst_key_t *key);
 
+isc_boolean_t
+dst_key_isnullkey(const dst_key_t *key);
+
 /* Computes the size of a signature generated by the given key.
  *
  * Requires: