diff --git a/validator/validator.c b/validator/validator.c
index 4958a2242..be4e7c3ed 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -2007,13 +2007,15 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 		anchor = anchors_lookup(qstate->env->anchors, 
 			lookup_name, lookup_len, vq->qchase.qclass);
 		if(!anchor) { /* unsigned parent denies anchor*/
-			verbose(VERB_QUERY, "unsigned parent zone denies"
-				" trust anchor, indeterminate");
-			vq->chase_reply->security = sec_status_indeterminate;
-			update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSSEC_INDETERMINATE);
+			verbose(VERB_ALGO, "unsigned parent zone denies"
+				" trust anchor, thus bogus");
+			errinf_ede(qstate, "unsigned parent zone denies trust anchor, thus bogus", LDNS_EDE_DNSSEC_BOGUS);
+			vq->chase_reply->security = sec_status_bogus;
+			update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSSEC_BOGUS);
 			vq->state = VAL_FINISHED_STATE;
 			return 1;
 		}
+		vq->parent_denial_must_be_secure = 1;
 		verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
 	} else if(subtype == VAL_CLASS_POSITIVE &&
 		qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
@@ -2538,6 +2540,15 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	enum val_classification subtype = val_classify_response(
 		qstate->query_flags, &qstate->qinfo, &vq->qchase, 
 		vq->orig_msg->rep, vq->rrset_skip);
+	if(vq->parent_denial_must_be_secure) {
+		if(vq->chase_reply->security != sec_status_secure &&
+			vq->chase_reply->security != sec_status_bogus) {
+			verbose(VERB_ALGO, "parent denial of trust island subdomain is not secure, thus bogus");
+			vq->chase_reply->security = sec_status_bogus;
+			update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSSEC_BOGUS);
+			errinf_ede(qstate, "parent denial of trust island subdomain is not secure, thus bogus", LDNS_EDE_DNSSEC_BOGUS);
+		}
+	}
 
 	/* store overall validation result in orig_msg */
 	if(vq->rrset_skip == 0) {
diff --git a/validator/validator.h b/validator/validator.h
index f7bc3550a..ab88fe124 100644
--- a/validator/validator.h
+++ b/validator/validator.h
@@ -244,6 +244,10 @@ struct val_qstate {
 	int num_nsec_attempts;
 	/** The nsec attempts have been exceeded. */
 	int num_nsec_attempts_exceeded;
+
+	/** if validation must be secure, (else bogus) for NXDOMAIN
+	 * from signed parent to (removed) trust anchor subdomain. */
+	int parent_denial_must_be_secure;
 };
 
 /**