diff --git a/services/authzone.c b/services/authzone.c
index 72b37fef9..b3fb09e64 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -392,6 +392,20 @@ auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg))
 	auth_data_delete(z);
 }
 
+/** delete chunklist */
+static void
+auth_chunk_list_delete(struct auth_chunk* first)
+{
+	struct auth_chunk* c, *cn;
+	c = first;
+	while(c) {
+		cn = c->next;
+		free(c->data);
+		free(c);
+		c = cn;
+	}
+}
+
 /** delete an auth zone structure (tree remove must be done elsewhere) */
 static void
 auth_zone_delete(struct auth_zone* z, struct auth_zones* az)
@@ -413,6 +427,7 @@ auth_zone_delete(struct auth_zone* z, struct auth_zones* az)
 	}
 	if(z->rpz)
 		rpz_delete(z->rpz);
+	auth_chunk_list_delete(z->perform_write_chunk_list);
 	free(z->name);
 	free(z->zonefile);
 	free(z);
@@ -2369,14 +2384,7 @@ static void
 auth_chunks_delete(struct auth_transfer* at)
 {
 	if(at->chunks_first) {
-		struct auth_chunk* c, *cn;
-		c = at->chunks_first;
-		while(c) {
-			cn = c->next;
-			free(c->data);
-			free(c);
-			c = cn;
-		}
+		auth_chunk_list_delete(at->chunks_first);
 	}
 	at->chunks_first = NULL;
 	at->chunks_last = NULL;
@@ -3593,7 +3601,13 @@ int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo,
 		*fallback = 1;
 		return 0;
 	}
-	if(z->zone_expired) {
+	if(z->zone_expired || (z->zonemd_check && z->zonemd_callback_env)) {
+		/* Do not serve from a zonemd-check zone while its ZONEMD
+		 * verification is still pending: the content is not yet known
+		 * to pass the configured check. The pending marker
+		 * (zonemd_callback_env) is set under z->lock when the async
+		 * lookup is spawned and cleared by the callback under z->lock,
+		 * so this test is race-free. */
 		*fallback = z->fallback_enabled;
 		lock_rw_unlock(&z->lock);
 		return 0;
@@ -3695,7 +3709,10 @@ int auth_zones_downstream_answer(struct auth_zones* az, struct module_env* env,
 		lock_rw_unlock(&z->lock);
 		return 0;
 	}
-	if(z->zone_expired) {
+	if(z->zone_expired || (z->zonemd_check && z->zonemd_callback_env)) {
+		/* see auth_zones_lookup: a pending ZONEMD verification is
+		 * treated like expiry - the zone content is not yet known
+		 * to pass the configured check. */
 		if(z->fallback_enabled) {
 			lock_rw_unlock(&z->lock);
 			return 0;
@@ -5299,7 +5316,7 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 
 /** write http chunks to zonefile to create downloaded file */
 static int
-auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
+auth_zone_write_chunks(struct auth_chunk* chunk_list, const char* fname)
 {
 	FILE* out;
 	struct auth_chunk* p;
@@ -5308,7 +5325,7 @@ auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
 		log_err("could not open %s: %s", fname, strerror(errno));
 		return 0;
 	}
-	for(p = xfr->task_transfer->chunks_first; p ; p = p->next) {
+	for(p = chunk_list; p ; p = p->next) {
 		if(!write_out(out, (char*)p->data, p->len)) {
 			log_err("could not write http download to %s", fname);
 			fclose(out);
@@ -5319,34 +5336,18 @@ auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
 	return 1;
 }
 
-/** write to zonefile after zone has been updated */
+/** write to zonefile after zone has been updated, z has rdlock by caller. */
 static void
-xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
+zone_write_after_update(struct auth_zone* z, struct module_env* env,
+	struct auth_chunk* chunk_list)
 {
 	struct config_file* cfg = env->cfg;
-	struct auth_zone* z;
 	char tmpfile[1024];
 	char* zfilename;
-	lock_basic_unlock(&xfr->lock);
-
-	/* get lock again, so it is a readlock and concurrently queries
-	 * can be answered */
-	lock_rw_rdlock(&env->auth_zones->lock);
-	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
-		xfr->dclass);
-	if(!z) {
-		lock_rw_unlock(&env->auth_zones->lock);
-		/* the zone is gone, ignore xfr results */
-		lock_basic_lock(&xfr->lock);
-		return;
-	}
-	lock_rw_rdlock(&z->lock);
-	lock_basic_lock(&xfr->lock);
-	lock_rw_unlock(&env->auth_zones->lock);
 
 	if(z->zonefile == NULL || z->zonefile[0] == 0) {
-		lock_rw_unlock(&z->lock);
 		/* no write needed, no zonefile set */
+		auth_chunk_list_delete(chunk_list);
 		return;
 	}
 	zfilename = z->zonefile;
@@ -5363,21 +5364,21 @@ xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
 	if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) {
 		verbose(VERB_ALGO, "tmpfilename too long, cannot update "
 			" zonefile %s", zfilename);
-		lock_rw_unlock(&z->lock);
+		auth_chunk_list_delete(chunk_list);
 		return;
 	}
 	snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename,
 		(unsigned)getpid());
-	if(xfr->task_transfer->master->http) {
+	if(chunk_list) {
 		/* use the stored chunk list to write them */
-		if(!auth_zone_write_chunks(xfr, tmpfile)) {
+		if(!auth_zone_write_chunks(chunk_list, tmpfile)) {
 			unlink(tmpfile);
-			lock_rw_unlock(&z->lock);
+			auth_chunk_list_delete(chunk_list);
 			return;
 		}
+		auth_chunk_list_delete(chunk_list);
 	} else if(!auth_zone_write_file(z, tmpfile)) {
 		unlink(tmpfile);
-		lock_rw_unlock(&z->lock);
 		return;
 	}
 #ifdef UB_ON_WINDOWS
@@ -5387,9 +5388,57 @@ xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
 		log_err("could not rename(%s, %s): %s", tmpfile, zfilename,
 			strerror(errno));
 		unlink(tmpfile);
-		lock_rw_unlock(&z->lock);
 		return;
 	}
+}
+
+/** write to zonefile after zone has updated, reacquires z readlock. */
+static void
+zone_write_after_update_reacq(uint8_t* bakname, size_t baknamelen,
+	uint16_t bakdclass, struct module_env* env,
+	struct auth_chunk* chunk_list)
+{
+	struct auth_zone* z;
+	/* get lock again, so it is a readlock and concurrently queries
+	 * can be answered */
+	lock_rw_rdlock(&env->auth_zones->lock);
+	z = auth_zone_find(env->auth_zones, bakname, baknamelen, bakdclass);
+	if(!z) {
+		lock_rw_unlock(&env->auth_zones->lock);
+		/* the zone is gone, ignore xfr results */
+		return;
+	}
+	lock_rw_rdlock(&z->lock);
+	lock_rw_unlock(&env->auth_zones->lock);
+
+	zone_write_after_update(z, env, chunk_list);
+	lock_rw_unlock(&z->lock);
+}
+
+/** write to zonefile after zone has been updated */
+static void
+xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env,
+	struct auth_chunk* chunk_list)
+{
+	struct auth_zone* z;
+	lock_basic_unlock(&xfr->lock);
+
+	/* get lock again, so it is a readlock and concurrently queries
+	 * can be answered */
+	lock_rw_rdlock(&env->auth_zones->lock);
+	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
+		xfr->dclass);
+	if(!z) {
+		lock_rw_unlock(&env->auth_zones->lock);
+		/* the zone is gone, ignore xfr results */
+		lock_basic_lock(&xfr->lock);
+		return;
+	}
+	lock_rw_rdlock(&z->lock);
+	lock_basic_lock(&xfr->lock);
+	lock_rw_unlock(&env->auth_zones->lock);
+
+	zone_write_after_update(z, env, chunk_list);
 	lock_rw_unlock(&z->lock);
 }
 
@@ -5422,6 +5471,8 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 	int* ixfr_fail)
 {
 	struct auth_zone* z;
+	int zonemd_in_progress;
+	struct auth_chunk* current_chunk_list = NULL;
 
 	/* obtain locks and structures */
 	lock_basic_unlock(&xfr->lock);
@@ -5505,6 +5556,25 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 	if(z->rpz)
 		rpz_finish_config(z->rpz);
 
+	if(z->zonemd_check && z->zonemd_callback_env) {
+		zonemd_in_progress = 1;
+		z->zonemd_callback_perform_write = 1;
+		auth_chunk_list_delete(z->perform_write_chunk_list);
+		z->perform_write_chunk_list = NULL;
+		if(xfr->task_transfer->master->http) {
+			z->perform_write_chunk_list = xfr->task_transfer->chunks_first;
+			xfr->task_transfer->chunks_first = NULL;
+			auth_chunks_delete(xfr->task_transfer);
+		}
+	} else {
+		zonemd_in_progress = 0;
+		z->zonemd_callback_perform_write = 0;
+		if(xfr->task_transfer->master->http) {
+			current_chunk_list = xfr->task_transfer->chunks_first;
+			xfr->task_transfer->chunks_first = NULL;
+			auth_chunks_delete(xfr->task_transfer);
+		}
+	}
 	/* unlock */
 	lock_rw_unlock(&z->lock);
 
@@ -5515,7 +5585,9 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 			(unsigned)xfr->serial);
 	}
 	/* see if we need to write to a zonefile */
-	xfr_write_after_update(xfr, env);
+	if(!zonemd_in_progress) {
+		xfr_write_after_update(xfr, env, current_chunk_list);
+	}
 	return 1;
 }
 
@@ -8601,9 +8673,13 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 	char reasonbuf[256];
 	char* reason = NULL, *ds_bogus = NULL, *typestr="DNSKEY";
 	struct ub_packed_rrset_key* dnskey = NULL, *ds = NULL;
-	int is_insecure = 0, downprot;
+	int is_insecure = 0, downprot, perform_write = 0;
 	struct ub_packed_rrset_key keystorage;
 	uint8_t sigalg[ALGO_NEEDS_MAX+1];
+	uint8_t bakname[LDNS_MAX_DOMAINLEN];
+	size_t baknamelen;
+	uint16_t bakdclass;
+	struct auth_chunk* chunk_list = NULL;
 
 	lock_rw_wrlock(&z->lock);
 	env = z->zonemd_callback_env;
@@ -8726,7 +8802,37 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 	auth_zone_verify_zonemd_with_key(z, env, &env->mesh->mods, dnskey,
 		is_insecure, NULL, downprot?sigalg:NULL);
 	regional_free_all(env->scratch);
+
+	if(z->zonemd_callback_perform_write) {
+		if(!z->zone_expired) {
+			/* Write to zonefile if the ZONEMD is okay. */
+			perform_write = 1;
+			/* copy the key to lookup the z structure.
+			 * The new lookup is readonly so concurrent
+			 * queries can continue. */
+			if(z->namelen > sizeof(bakname)) {
+				perform_write = 0;
+				auth_chunk_list_delete(z->perform_write_chunk_list);
+				z->perform_write_chunk_list = NULL;
+			} else {
+				memcpy(bakname, z->name, z->namelen);
+				baknamelen = z->namelen;
+				bakdclass = z->dclass;
+				chunk_list = z->perform_write_chunk_list;
+				z->perform_write_chunk_list = NULL;
+			}
+		} else {
+			auth_chunk_list_delete(z->perform_write_chunk_list);
+			z->perform_write_chunk_list = NULL;
+		}
+		z->zonemd_callback_perform_write = 0;
+	}
 	lock_rw_unlock(&z->lock);
+
+	if(perform_write) {
+		zone_write_after_update_reacq(bakname, baknamelen, bakdclass,
+			env, chunk_list);
+	}
 }
 
 /** lookup DNSKEY for ZONEMD verification */
@@ -8794,6 +8900,9 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env)
 		&auth_zonemd_dnskey_lookup_callback, z, 0,
 		&z->zonemd_callback_unique_info)) {
 		lock_rw_wrlock(&z->lock);
+		/* no callback will run; do not leave the pending
+		 * marker set */
+		z->zonemd_callback_env = NULL;
 		log_err("out of memory lookup of %s for zonemd",
 			(fetch_ds?"DS":"DNSKEY"));
 		return 0;
diff --git a/services/authzone.h b/services/authzone.h
index 97ab01fcb..24c8c80b5 100644
--- a/services/authzone.h
+++ b/services/authzone.h
@@ -146,6 +146,10 @@ struct auth_zone {
 	uint16_t zonemd_callback_qtype;
 	/** for the zonemd callback, the unique info */
 	void* zonemd_callback_unique_info;
+	/** if the zonemd callback should write to file */
+	int zonemd_callback_perform_write;
+	/** chunklist to write for chunked transfer. */
+	struct auth_chunk* perform_write_chunk_list;
 	/** zone has been deleted */
 	int zone_deleted;
 	/** deletelist pointer, unused normally except during delete */