diff --git a/src/resolve/resolved-dns-answer.c b/src/resolve/resolved-dns-answer.c
index 55e6ffbad76..6a37345e7e0 100644
--- a/src/resolve/resolved-dns-answer.c
+++ b/src/resolve/resolved-dns-answer.c
@@ -228,9 +228,9 @@ int dns_answer_contains_rr(DnsAnswer *a, DnsResourceRecord *rr) {
 
 int dns_answer_find_soa(DnsAnswer *a, const DnsResourceKey *key, DnsResourceRecord **ret) {
         DnsResourceRecord *rr;
+        int r;
 
         assert(key);
-        assert(ret);
 
         if (!a)
                 return 0;
@@ -240,8 +240,12 @@ int dns_answer_find_soa(DnsAnswer *a, const DnsResourceKey *key, DnsResourceReco
                 return 0;
 
         DNS_ANSWER_FOREACH(rr, a) {
-                if (dns_resource_key_match_soa(key, rr->key)) {
-                        *ret = rr;
+                r = dns_resource_key_match_soa(key, rr->key);
+                if (r < 0)
+                        return r;
+                if (r > 0) {
+                        if (ret)
+                                *ret = rr;
                         return 1;
                 }
         }
@@ -251,6 +255,7 @@ int dns_answer_find_soa(DnsAnswer *a, const DnsResourceKey *key, DnsResourceReco
 
 int dns_answer_find_cname_or_dname(DnsAnswer *a, const DnsResourceKey *key, DnsResourceRecord **ret) {
         DnsResourceRecord *rr;
+        int r;
 
         assert(key);
 
@@ -262,7 +267,10 @@ int dns_answer_find_cname_or_dname(DnsAnswer *a, const DnsResourceKey *key, DnsR
                 return 0;
 
         DNS_ANSWER_FOREACH(rr, a) {
-                if (dns_resource_key_match_cname_or_dname(key, rr->key, NULL)) {
+                r = dns_resource_key_match_cname_or_dname(key, rr->key, NULL);
+                if (r < 0)
+                        return r;
+                if (r > 0) {
                         if (ret)
                                 *ret = rr;
                         return 1;