diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 25035ed7ee2..b76f981906b 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -1712,10 +1712,12 @@ int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
                 if (r < 0)
                         goto fail;
 
-                r = dns_packet_append_types(p, rr->nsec3.types, NULL);
+                r = dns_packet_read_type_windows(p, &rr->nsec.types, offset + rdlength - p->rindex, NULL);
                 if (r < 0)
                         goto fail;
 
+                /* empty non-terminals can have NSEC3 records, so empty bitmaps are allowed */
+
                 break;
         }
         default: