diff --git a/sys/src/cmd/ndb/dnserver.c b/sys/src/cmd/ndb/dnserver.c
index f55d38af1..5a00eead2 100644
--- a/sys/src/cmd/ndb/dnserver.c
+++ b/sys/src/cmd/ndb/dnserver.c
@@ -65,7 +65,8 @@ dnserver(DNSmsg *reqp, DNSmsg *repp, Request *req, uchar *srcip, int rcode)
 		if(cfg.nonrecursive
 		|| cfg.localrecursive && !localip(srcip)){
 			/* we don't recurse and we're not authoritative */
-			neg = nil;
+			setercode(repp, Rrefused);
+			return;
 		} else {
 			repp->flags |= Fcanrec;
 			if(reqp->flags & Frecurse){