diff --git a/lib/dns/rdata/any_255/tsig_250.c b/lib/dns/rdata/any_255/tsig_250.c
index 538c9ec1f62a70f6fe9de0e7811a1165fe7095be..5cb24b2b5d5232667ce4960a5c757f01991d83f8 100644
--- a/lib/dns/rdata/any_255/tsig_250.c
+++ b/lib/dns/rdata/any_255/tsig_250.c
@@ -187,22 +187,26 @@ totext_any_tsig(ARGS_TOTEXT) {
 	/*
 	 * Signature.
 	 */
-	REQUIRE(n <= sr.length);
-	sigr = sr;
-	sigr.length = n;
-	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
-		RETERR(str_totext(" (", target));
-	RETERR(str_totext(tctx->linebreak, target));
-	if (tctx->width == 0)   /* No splitting */
-		RETERR(isc_base64_totext(&sigr, 60, "", target));
-	else
-		RETERR(isc_base64_totext(&sigr, tctx->width - 2,
-					 tctx->linebreak, target));
-	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
-		RETERR(str_totext(" ) ", target));
-	else
+	if (n != 0U) {
+		REQUIRE(n <= sr.length);
+		sigr = sr;
+		sigr.length = n;
+		if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+			RETERR(str_totext(" (", target));
+		RETERR(str_totext(tctx->linebreak, target));
+		if (tctx->width == 0)   /* No splitting */
+			RETERR(isc_base64_totext(&sigr, 60, "", target));
+		else
+			RETERR(isc_base64_totext(&sigr, tctx->width - 2,
+						 tctx->linebreak, target));
+		if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+			RETERR(str_totext(" ) ", target));
+		else
+			RETERR(str_totext(" ", target));
+		isc_region_consume(&sr, n);
+	} else {
 		RETERR(str_totext(" ", target));
-	isc_region_consume(&sr, n);
+	}
 
 	/*
 	 * Original ID.