--- /dev/null
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -20,7 +20,7 @@
+ #ifdef HAVE_DNSSEC
+
+ #include <nettle/rsa.h>
+-#include <nettle/dsa.h>
++#include <nettle/dsa-compat.h>
+ #ifndef NO_NETTLE_ECC
+ # include <nettle/ecdsa.h>
+ # include <nettle/ecc-curve.h>
+@@ -173,7 +173,7 @@ static int rsa_verify(struct blockdata *
+ return 0;
+ }
+
+-static int dsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
++static int dnsmasq_dsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
+ unsigned char *digest, int algo)
+ {
+ unsigned char *p;
+@@ -296,7 +296,7 @@ static int verify(struct blockdata *key_
+ return rsa_verify(key_data, key_len, sig, sig_len, digest, algo);
+
+ case 3: case 6:
+- return dsa_verify(key_data, key_len, sig, sig_len, digest, algo);
++ return dnsmasq_dsa_verify(key_data, key_len, sig, sig_len, digest, algo);
+
+ #ifndef NO_NETTLE_ECC
+ case 13: case 14: