diff --git a/lib/isc/netmgr/netmgr-int.h b/lib/isc/netmgr/netmgr-int.h
index 765ac925b7..7a31b74e97 100644
--- a/lib/isc/netmgr/netmgr-int.h
+++ b/lib/isc/netmgr/netmgr-int.h
@@ -1403,9 +1403,10 @@ isc__nm_socket_incoming_cpu(uv_os_sock_t fd);
  */
 
 isc_result_t
-isc__nm_socket_dontfrag(uv_os_sock_t fd, sa_family_t sa_family);
+isc__nm_socket_disable_pmtud(uv_os_sock_t fd, sa_family_t sa_family);
 /*%<
- * Set the SO_IP_DONTFRAG (or equivalent) socket option of the fd if available
+ * Disable the Path MTU Discovery, either by disabling IP(V6)_DONTFRAG socket
+ * option, or setting the IP(V6)_MTU_DISCOVER socket option to IP_PMTUDISC_OMIT
  */
 
 isc_result_t
diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
index c6bcaea16d..bdae06c863 100644
--- a/lib/isc/netmgr/netmgr.c
+++ b/lib/isc/netmgr/netmgr.c
@@ -2938,20 +2938,20 @@ isc__nm_socket_incoming_cpu(uv_os_sock_t fd) {
 }
 
 isc_result_t
-isc__nm_socket_dontfrag(uv_os_sock_t fd, sa_family_t sa_family) {
+isc__nm_socket_disable_pmtud(uv_os_sock_t fd, sa_family_t sa_family) {
 	/*
-	 * Set the Don't Fragment flag on IP packets
+	 * Disable the Path MTU Discovery on IP packets
 	 */
 	if (sa_family == AF_INET6) {
 #if defined(IPV6_DONTFRAG)
-		if (setsockopt_on(fd, IPPROTO_IPV6, IPV6_DONTFRAG) == -1) {
+		if (setsockopt_off(fd, IPPROTO_IPV6, IPV6_DONTFRAG) == -1) {
 			return (ISC_R_FAILURE);
 		} else {
 			return (ISC_R_SUCCESS);
 		}
-#elif defined(IPV6_MTU_DISCOVER)
+#elif defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
 		if (setsockopt(fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
-			       &(int){ IP_PMTUDISC_DO }, sizeof(int)) == -1)
+			       &(int){ IP_PMTUDISC_OMIT }, sizeof(int)) == -1)
 		{
 			return (ISC_R_FAILURE);
 		} else {
@@ -2962,14 +2962,14 @@ isc__nm_socket_dontfrag(uv_os_sock_t fd, sa_family_t sa_family) {
 #endif
 	} else if (sa_family == AF_INET) {
 #if defined(IP_DONTFRAG)
-		if (setsockopt_on(fd, IPPROTO_IP, IP_DONTFRAG) == -1) {
+		if (setsockopt_off(fd, IPPROTO_IP, IP_DONTFRAG) == -1) {
 			return (ISC_R_FAILURE);
 		} else {
 			return (ISC_R_SUCCESS);
 		}
-#elif defined(IP_MTU_DISCOVER)
+#elif defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
 		if (setsockopt(fd, IPPROTO_IP, IP_MTU_DISCOVER,
-			       &(int){ IP_PMTUDISC_DO }, sizeof(int)) == -1)
+			       &(int){ IP_PMTUDISC_OMIT }, sizeof(int)) == -1)
 		{
 			return (ISC_R_FAILURE);
 		} else {
diff --git a/lib/isc/netmgr/udp.c b/lib/isc/netmgr/udp.c
index c47cb86257..a91c425a8e 100644
--- a/lib/isc/netmgr/udp.c
+++ b/lib/isc/netmgr/udp.c
@@ -65,7 +65,7 @@ isc__nm_udp_lb_socket(sa_family_t sa_family) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 	(void)isc__nm_socket_incoming_cpu(sock);
-	(void)isc__nm_socket_dontfrag(sock, sa_family);
+	(void)isc__nm_socket_disable_pmtud(sock, sa_family);
 
 	result = isc__nm_socket_reuse(sock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -783,7 +783,7 @@ isc_nm_udpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 
 	(void)isc__nm_socket_incoming_cpu(sock->fd);
 
-	(void)isc__nm_socket_dontfrag(sock->fd, sa_family);
+	(void)isc__nm_socket_disable_pmtud(sock->fd, sa_family);
 
 	event = isc__nm_get_netievent_udpconnect(mgr, sock, req);
 
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index bc260d222f..9e02cea9f6 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -2100,27 +2100,27 @@ set_tcp_maxseg(isc_socket_t *sock, int size) {
 }
 
 static void
-set_ip_dontfrag(isc_socket_t *sock) {
+set_ip_disable_pmtud(isc_socket_t *sock) {
 	/*
-	 * Set the Don't Fragment flag on IP packets
+	 * Disable Path MTU Discover on IP packets
 	 */
 	if (sock->pf == AF_INET6) {
 #if defined(IPV6_DONTFRAG)
 		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_DONTFRAG,
-				 &(int){ 1 }, sizeof(int));
+				 &(int){ 0 }, sizeof(int));
 #endif
-#if defined(IPV6_MTU_DISCOVER)
+#if defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
 		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
-				 &(int){ IP_PMTUDISC_DO }, sizeof(int));
+				 &(int){ IP_PMTUDISC_OMIT }, sizeof(int));
 #endif
 	} else if (sock->pf == AF_INET) {
 #if defined(IP_DONTFRAG)
-		(void)setsockopt(sock->fd, IPPROTO_IP, IP_DONTFRAG, &(int){ 1 },
+		(void)setsockopt(sock->fd, IPPROTO_IP, IP_DONTFRAG, &(int){ 0 },
 				 sizeof(int));
 #endif
-#if defined(IP_MTU_DISCOVER)
+#if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
 		(void)setsockopt(sock->fd, IPPROTO_IP, IP_MTU_DISCOVER,
-				 &(int){ IP_PMTUDISC_DO }, sizeof(int));
+				 &(int){ IP_PMTUDISC_OMIT }, sizeof(int));
 #endif
 	}
 }
@@ -2411,7 +2411,7 @@ again:
 #endif /* ifdef IP_RECVTOS */
 #endif /* defined(USE_CMSG) || defined(SET_RCVBUF) || defined(SET_SNDBUF) */
 
-	set_ip_dontfrag(sock);
+	set_ip_disable_pmtud(sock);
 
 setup_done:
 	inc_stats(manager->stats, sock->statsindex[STATID_OPEN]);
diff --git a/lib/ns/client.c b/lib/ns/client.c
index d76b7b91f0..899ef129d3 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -794,8 +794,6 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 		dns_rrl_result_t rrl_result;
 		int loglevel;
 
-		INSIST(rcode != dns_rcode_noerror &&
-		       rcode != dns_rcode_nxdomain);
 		if ((client->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
 			loglevel = DNS_RRL_LOG_DROP;
 		} else {