diff --git a/bin/named/server.c b/bin/named/server.c
index 0cbd462b1de49e3b089fb5a6e2f667ada3dd10a0..e7f87e349e9e72d9180f7abb6a1a500ac86c226f 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -11447,6 +11447,11 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		     isc_quota_getmax(&server->sctx->tcpquota));
 	CHECK(putstr(text, line));
 
+	snprintf(line, sizeof(line), "TCP high-water: %u\n",
+		     (unsigned)ns_stats_get_counter(server->sctx->nsstats,
+					  ns_statscounter_tcphighwater));
+	CHECK(putstr(text, line));
+
 	if (server->reload_status != NAMED_RELOAD_DONE) {
 		snprintf(line, sizeof(line), "reload/reconfig %s\n",
 			 server->reload_status == NAMED_RELOAD_FAILED
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index d7f864acec26edae58db0e3f7979b0382a7c40d0..a955d7b207fb2ae8d6e4eb7fc6af72d25c2a5008 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -241,6 +241,8 @@ init_desc(void) {
 	SET_NSSTATDESC(invalidsig, "requests with invalid signature",
 		       "ReqBadSIG");
 	SET_NSSTATDESC(requesttcp, "TCP requests received", "ReqTCP");
+	SET_NSSTATDESC(tcphighwater, "TCP connection high-water",
+		       "TCPConnHighWater");
 	SET_NSSTATDESC(authrej, "auth queries rejected", "AuthQryRej");
 	SET_NSSTATDESC(recurserej, "recursive queries rejected", "RecQryRej");
 	SET_NSSTATDESC(xfrrej, "transfer requests rejected", "XfrRej");
@@ -322,6 +324,7 @@ init_desc(void) {
 		       "QryUsedStale");
 	SET_NSSTATDESC(prefetch, "queries triggered prefetch", "Prefetch");
 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
+
 	INSIST(i == ns_statscounter_max);
 
 	/* Initialize resolver statistics */
diff --git a/lib/isc/stats.c b/lib/isc/stats.c
index 1df53498a95d1d499701b29e593052d7f4212d2e..44cc2d4e1bc648af03979ffecfcb0adcd8a1aaf0 100644
--- a/lib/isc/stats.c
+++ b/lib/isc/stats.c
@@ -29,17 +29,17 @@
 #define ISC_STATS_VALID(x)		ISC_MAGIC_VALID(x, ISC_STATS_MAGIC)
 
 #if defined(_WIN32) && !defined(_WIN64)
-typedef atomic_int_fast32_t isc_stat_t;
+	typedef atomic_int_fast32_t isc__atomic_statcounter_t;
 #else
-typedef atomic_int_fast64_t isc_stat_t;
+	typedef atomic_int_fast64_t isc__atomic_statcounter_t;
 #endif
 
 struct isc_stats {
-	unsigned int		magic;
-	isc_mem_t		*mctx;
-	isc_refcount_t		references;
-	int			ncounters;
-	isc_stat_t		*counters;
+	unsigned int			magic;
+	isc_mem_t			*mctx;
+	isc_refcount_t			references;
+	int				ncounters;
+	isc__atomic_statcounter_t	*counters;
 };
 
 static isc_result_t
diff --git a/lib/ns/client.c b/lib/ns/client.c
index f16ece8c49f1ffa54523256d74f2f7c8a2d8e816..598e41179ec38ed4b3b7a48679aa867f982ff0e7 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -3400,7 +3400,6 @@ client_accept(ns_client_t *client) {
 	isc_result_t result;
 
 	CTRACE("accept");
-
 	/*
 	 * Set up a new TCP connection. This means try to attach to the
 	 * TCP client quota (tcp-clients), but fail if we're over quota.
@@ -3451,6 +3450,12 @@ client_accept(ns_client_t *client) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	}
 
+	/* TCP high-water stats update. */
+	unsigned int curr_tcpquota = isc_quota_getused(&client->sctx->tcpquota);
+	ns_stats_update_if_greater(client->sctx->nsstats,
+				   ns_statscounter_tcphighwater,
+				   curr_tcpquota);
+
 	/*
 	 * If this client was set up using get_client() or get_worker(),
 	 * then TCP is already marked active. However, if it was restarted
diff --git a/lib/ns/include/ns/stats.h b/lib/ns/include/ns/stats.h
index f456a971b0a2b112b329dc45071e98aea31c544a..175813113ebffa3ff6f5f797499c533e044869cf 100644
--- a/lib/ns/include/ns/stats.h
+++ b/lib/ns/include/ns/stats.h
@@ -102,7 +102,9 @@ enum {
 	ns_statscounter_prefetch = 63,
 	ns_statscounter_keytagopt = 64,
 
-	ns_statscounter_max = 65
+	ns_statscounter_tcphighwater = 65,
+
+	ns_statscounter_max = 66,
 };
 
 void