diff --git a/src/auth.c b/src/auth.c
index 7446580..854af0d 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -836,6 +836,9 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
       header->hb4 &= ~HB4_RA;
     }
 
+  /* data is never DNSSEC signed. */
+  header->hb4 &= ~HB4_AD;
+
   /* authoritative */
   if (auth)
     header->hb3 |= HB3_AA;