diff -u ./source4/rpc_server/dnsserver/dcerpc_dnsserver.c.orig ./source4/rpc_server/dnsserver/dcerpc_dnsserver.c
--- ./source4/rpc_server/dnsserver/dcerpc_dnsserver.c.orig	2017-05-20 19:09:24.552000000 +0200
+++ ./source4/rpc_server/dnsserver/dcerpc_dnsserver.c	2017-05-20 19:42:06.108000000 +0200
@@ -1818,11 +1818,12 @@
 
 			/* Search all the available zones for additional name */
 			for (z2 = dsstate->zones; z2; z2 = z2->next) {
+			        res  = NULL;
 				name = dns_split_node_name(tmp_ctx, add_names[i], z2->name);
-				ret = ldb_search(dsstate->samdb, tmp_ctx, &res, z2->zone_dn,
-						LDB_SCOPE_ONELEVEL, attrs,
-						"(&(objectClass=dnsNode)(name=%s)(!(dNSTombstoned=TRUE)))",
-						name);
+				ret  = ldb_search(dsstate->samdb, tmp_ctx, &res, z2->zone_dn,
+						  LDB_SCOPE_ONELEVEL, attrs,
+						  "(&(objectClass=dnsNode)(name=%s)(!(dNSTombstoned=TRUE)))",
+						  name);
 				talloc_free(name);
 				if (ret != LDB_SUCCESS) {
 					continue;
@@ -1831,6 +1832,7 @@
 					break;
 				} else {
 					talloc_free(res);
+					res = NULL;
 					continue;
 				}
 			}
@@ -1841,12 +1843,14 @@
 			} else {
 				rname = talloc_asprintf(tmp_ctx, "%s.", add_names[i]);
 			}
+
 			status = dns_fill_records_array(tmp_ctx, NULL, DNS_TYPE_A,
 							select_flag, rname,
-							res->msgs[0], 0, recs,
+							(res && res->count > 0) ? res->msgs[0] : NULL, 0, recs,
 							NULL, NULL);
-			talloc_free(rname);
-			talloc_free(res);
+			talloc_free (rname);
+			talloc_free (res);
+			res = NULL;
 		}
 	}