diff --git a/src/bin/d2/d2_hooks.dox b/src/bin/d2/d2_hooks.dox
index d532571b6a..66749c6389 100644
--- a/src/bin/d2/d2_hooks.dox
+++ b/src/bin/d2/d2_hooks.dox
@@ -50,7 +50,8 @@ to the end of this list.
  - @b Arguments:
    - name: @b io_context, type: isc::asiolink::IOServicePtr, direction: <b>in</b>
    - name: @b json_config, type: isc::data::ConstElementPtr, direction: <b>in</b>
-   - name: @b server_config, type: isc::dhcp::SrvConfigPtr, direction: <b>in</b>
+   - name: @b server_config, type: isc::d2::D2CfgContextPtr, direction: <b>in</b>
+   - name: @b error, type: std::string, direction: <b>out</b>
 
  - @b Description: this callout is executed when the server has completed
    its (re)configuration. The server provides received and parsed configuration
@@ -58,9 +59,11 @@ to the end of this list.
    object which is used by the server to run asynchronous operations. The hooks
    libraries can use this IOService object to schedule asynchronous tasks which
    are triggered by the Kea DHCP DDNS's main loop. The hook library should hold
-   the provided pointer until the library is unloaded. 
+   the provided pointer until the library is unloaded. The D2CfgContext
+   object provides access to the D2 running configuration.
 
- - <b>Next step status</b>: Status codes returned by the callouts installed on
-   this hook point are ignored.
+ - <b>Next step status</b>: If any callout sets the status to DROP, the server
+   considers the configuration is incorrect and rejects it using the error
+   string as an error message.
 
 */
diff --git a/src/bin/d2/d2_process.cc b/src/bin/d2/d2_process.cc
index 8285b04f98..a85607a9d0 100644
--- a/src/bin/d2/d2_process.cc
+++ b/src/bin/d2/d2_process.cc
@@ -271,6 +271,7 @@ D2Process::configure(isc::data::ConstElementPtr config_set, bool check_only) {
     // to the common IO service object, new server configuration in the JSON
     // format and with the pointer to the configuration storage where the
     // parsed configuration is stored.
+    std::string error("");
     if (HooksManager::calloutsPresent(Hooks.hooks_index_d2_srv_configured_)) {
         CalloutHandlePtr callout_handle = HooksManager::createCalloutHandle();
 
@@ -278,12 +279,18 @@ D2Process::configure(isc::data::ConstElementPtr config_set, bool check_only) {
         callout_handle->setArgument("json_config", config_set);
         callout_handle->setArgument("server_config",
                                     getD2CfgMgr()->getD2CfgContext());
+        callout_handle->setArgument("error", error);
 
         HooksManager::callCallouts(Hooks.hooks_index_d2_srv_configured_,
                                    *callout_handle);
 
-        // Ignore status code as none of them would have an effect on further
-        // operation.
+        // The config can be rejected by a hook.
+        if (callout_handle->getStatus() == CalloutHandle::NEXT_STEP_DROP) {
+            callout_handle->getArgument("error", error);
+            reconf_queue_flag_ = false;
+            answer = isc::config::createAnswer(1, error);
+            return (answer);
+        }
     }
 
     // If we are here, configuration was valid, at least it parsed correctly