diff --git a/CHANGES b/CHANGES
index d19dd82d69..14a5ff11ed 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+6281.	[bug]		Fix a data race in dns_tsigkeyring_dump(). [GL #4328]
+
 6280.	[bug]		Fix missing newlines in the output of "rndc nta -dump".
 			[GL !8454]
 
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index b65c0b7baf..5583688e88 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -469,6 +469,7 @@ dns_tsigkeyring_dump(dns_tsigkeyring_t *ring, FILE *fp) {
 
 	REQUIRE(VALID_TSIGKEYRING(ring));
 
+	RWLOCK(&ring->lock, isc_rwlocktype_read);
 	isc_hashmap_iter_create(ring->keys, &it);
 	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
 	     result = isc_hashmap_iter_next(it))
@@ -482,6 +483,7 @@ dns_tsigkeyring_dump(dns_tsigkeyring_t *ring, FILE *fp) {
 		}
 	}
 	isc_hashmap_iter_destroy(&it);
+	RWUNLOCK(&ring->lock, isc_rwlocktype_read);
 
 	return (found ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
 }