diff --git a/lib/ns/client.c b/lib/ns/client.c
index a32d58f..c8904ff 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -2115,6 +2115,12 @@ process_keytag(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 		return (DNS_R_OPTERR);
 	}
 
+	/* Silently drop additional keytag options. */
+	if (client->keytag != NULL) {
+		isc_buffer_forward(buf, (unsigned int)optlen);
+		return (ISC_R_SUCCESS);
+	}
+
 	client->keytag = isc_mem_get(client->mctx, optlen);
 	if (client->keytag != NULL) {
 		client->keytag_len = (uint16_t)optlen;