diff --git a/bin/dnssec/dnssec-cds.c b/bin/dnssec/dnssec-cds.c
index 979b141916dc25cce5717e9af0d9411aebd030b1..955315f64de85aef01465db206c53cb600313aad 100644
--- a/bin/dnssec/dnssec-cds.c
+++ b/bin/dnssec/dnssec-cds.c
@@ -482,7 +482,6 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 		dns_rdata_ds_t ds;
 		dns_rdata_t dsrdata = DNS_RDATA_INIT;
 		dns_rdata_t newdsrdata = DNS_RDATA_INIT;
-		dns_rdatatype_t keytype;
 		bool c;
 
 		dns_rdataset_current(dsset, &dsrdata);
@@ -493,12 +492,8 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 			continue;
 		}
 
-		/* allow for both DNSKEY and CDNSKEY */
-		keytype = ki->rdata.type;
-		ki->rdata.type = dns_rdatatype_dnskey;
 		result = dns_ds_buildrdata(name, &ki->rdata, ds.digest_type,
 					   dsbuf, &newdsrdata);
-		ki->rdata.type = keytype;
 		if (result != ISC_R_SUCCESS) {
 			vbprintf(3, "dns_ds_buildrdata("
 				 "keytag=%d, algo=%d, digest=%d): %s\n",
@@ -826,7 +821,6 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 				return (ISC_R_NOSPACE);
 			}
 
-			cdnskey->type = dns_rdatatype_dnskey;
 			rdata = rdata_get();
 			result = dns_ds_buildrdata(name, cdnskey, dtype[i],
 						   r.base, rdata);
diff --git a/lib/dns/ds.c b/lib/dns/ds.c
index 02d62c4f3634e3d3089283c6d242ca49d6475475..e4d8131084afd6e0849385446a3d705f1a0a53d2 100644
--- a/lib/dns/ds.c
+++ b/lib/dns/ds.c
@@ -47,7 +47,8 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
 	isc_result_t ret;
 
 	REQUIRE(key != NULL);
-	REQUIRE(key->type == dns_rdatatype_dnskey);
+	REQUIRE(key->type == dns_rdatatype_dnskey ||
+		key->type == dns_rdatatype_cdnskey);
 
 	if (!dst_ds_digest_supported(digest_type)) {
 		return (ISC_R_NOTIMPLEMENTED);
diff --git a/lib/dns/include/dns/ds.h b/lib/dns/include/dns/ds.h
index 4ea5a0d24df22fa248034ae0db6c9baa9ac1dedb..122d6cd76d917f86d672f17ce13e7291954e6d2c 100644
--- a/lib/dns/include/dns/ds.h
+++ b/lib/dns/include/dns/ds.h
@@ -37,7 +37,7 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
  * Build the rdata of a DS record.
  *
  * Requires:
- *\li	key	Points to a valid DNS KEY record.
+ *\li	key	Points to a valid DNSKEY or CDNSKEY record.
  *\li	buffer	Points to a temporary buffer of at least
  * 		#DNS_DS_BUFFERSIZE bytes.
  *\li	rdata	Points to an initialized dns_rdata_t.