diff --git a/src/dnsmasq_interface.c b/src/dnsmasq_interface.c
index 292396cb..e18b4830 100644
--- a/src/dnsmasq_interface.c
+++ b/src/dnsmasq_interface.c
@@ -2184,6 +2184,10 @@ static void FTL_reply(const unsigned int flags, const char *name, const union al
 		//   name = google-public-dns-a.google.com
 		// Hence, isExactMatch is always false
 
+		// Set DNSSEC status to INSECURE if it is still unknown
+		if(query->dnssec == DNSSEC_UNSPECIFIED)
+			query_set_dnssec(query, DNSSEC_INSECURE);
+
 		// Save reply type and update individual reply counters
 		query_set_reply(flags, 0, addr, query, response);
 	}