diff --git a/src/dnssec.c b/src/dnssec.c
index 8b240dab..115b95c4 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -1360,7 +1360,7 @@ static void check_chain_complete(chain_head *chain)
 	getdns_list *val_chain_list;
 	getdns_dict *response_dict;
 #ifdef STUB_NATIVE_DNSSEC
-	uint8_t tas_spc[4096], *tas;
+	uint8_t tas_spc[4096], *tas = tas_spc;
 	size_t tas_sz;
 	gldns_buffer tas_buf;
 	rrset_iter tas_iter;
@@ -1375,19 +1375,25 @@ static void check_chain_complete(chain_head *chain)
 	context = dnsreq->context;
 
 #ifdef STUB_NATIVE_DNSSEC
-	gldns_buffer_init_frm_data(&tas_buf, (tas = tas_spc), sizeof(tas_spc));
-	_getdns_list2wire(&tas_buf, context->dnssec_trust_anchors);
-	if ((tas_sz = gldns_buffer_position(&tas_buf)) > sizeof(tas_spc)) {
-		if ((tas = GETDNS_XMALLOC(dnsreq->my_mf, uint8_t, tas_sz))) {
-			gldns_buffer_init_frm_data(&tas_buf, tas, tas_sz);
-			_getdns_list2wire(&tas_buf, context->dnssec_trust_anchors);
-		}
-	} else if (! GLDNS_ANCOUNT(tas))
-		tas = NULL;
+	if (chain->netreq->unbound_id == -1) {
+		gldns_buffer_init_frm_data(&tas_buf, tas, sizeof(tas_spc));
+		_getdns_list2wire(&tas_buf, context->dnssec_trust_anchors);
+		if ((tas_sz = gldns_buffer_position(&tas_buf))
+		    > sizeof(tas_spc)) {
+			if ((tas = GETDNS_XMALLOC(
+			    dnsreq->my_mf, uint8_t, tas_sz))) {
+				gldns_buffer_init_frm_data(
+				    &tas_buf, tas, tas_sz);
+				_getdns_list2wire(
+				    &tas_buf, context->dnssec_trust_anchors);
+			}
+		} else if (! GLDNS_ANCOUNT(tas))
+			tas = NULL;
 
-	if (tas)
-		chain_validate_dnssec(chain,
-		    rrset_iter_init(&tas_iter, tas, tas_sz));
+		if (tas)
+			chain_validate_dnssec(chain,
+			    rrset_iter_init(&tas_iter, tas, tas_sz));
+	}
 #endif
 
 	val_chain_list = dnsreq->dnssec_return_validation_chain