diff --git a/modules/tinydnsbackend/data b/modules/tinydnsbackend/data
index 06c8f6161170..c09744d5cff2 100644
--- a/modules/tinydnsbackend/data
+++ b/modules/tinydnsbackend/data
@@ -20190,7 +20190,9 @@ Zexample.com:ns1.example.com.:ahu.example.com.:2847484148:28800:7200:604800:8640
 :_underscore.test.com:16:\030underscores\040are\040terrible:3600
 :aland.test.com:16:\016\303\205LAND\040ISLANDS:3600
 :d.test.com:39:\002d2\005test2\003com\000:3600
-:enum.test.com:35:\000d\0002\001u\007e2u\053sip\000\010testuser\006domain\003com\000:3600
+:enam.test.com:35:\000d\0002\001a\007e2u\053sip\000\007server1\004test\003com\000:3600
+:ensm.test.com:35:\000d\0002\001s\007e2u\053sip\000\007_double\004_tcp\002dc\004test\003com\000:3600
+:enum.test.com:35:\000d\0002\001u\007e2u\053sip\000\007server1\004test\003com\000:3600
 :hightxt.test.com:16:\042v\075spf1\040mx\040ip4\07278.46.192.210\040\342\200\223all:3600
 :hightxt.test.com:99:\042v\075spf1\040mx\040ip4\07278.46.192.210\040\342\200\223all:3600
 :interrupted-rrset.test.com:16:\023check\040AXFR\040signpipe:3600
diff --git a/modules/tinydnsbackend/data.cdb b/modules/tinydnsbackend/data.cdb
index 98225edd8ca8..d23f0e588777 100644
Binary files a/modules/tinydnsbackend/data.cdb and b/modules/tinydnsbackend/data.cdb differ
diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index e63a5d9c8a8d..40c1ed2d8893 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -510,9 +510,11 @@ DNSName PacketHandler::doAdditionalServiceProcessing(const DNSName &firstTarget,
 }
 
 
+// NOLINTNEXTLINE(readability-function-cognitive-complexity)
 void PacketHandler::doAdditionalProcessing(DNSPacket& p, std::unique_ptr<DNSPacket>& r)
 {
   DNSName content;
+  DNSZoneRecord dzr;
   std::unordered_set<DNSName> lookup;
   vector<DNSZoneRecord> extraRecords;
   const auto& rrs = r->getRRS();
@@ -520,6 +522,7 @@ void PacketHandler::doAdditionalProcessing(DNSPacket& p, std::unique_ptr<DNSPack
   lookup.reserve(rrs.size());
   for(auto& rr : rrs) {
     if(rr.dr.d_place != DNSResourceRecord::ADDITIONAL) {
+      content.clear();
       switch(rr.dr.d_type) {
         case QType::NS:
           content=getRR<NSRecordContent>(rr.dr)->getNS();
@@ -542,10 +545,34 @@ void PacketHandler::doAdditionalProcessing(DNSPacket& p, std::unique_ptr<DNSPack
           }
           break;
         }
+        case QType::NAPTR: {
+          auto naptrContent = getRR<NAPTRRecordContent>(rr.dr);
+          auto flags = naptrContent->getFlags();
+          toLowerInPlace(flags);
+          if (flags.find('a') != string::npos) {
+            content = naptrContent->getReplacement();
+            DLOG(g_log<<Logger::Debug<<"adding NAPTR replacement 'a'="<<content<<endl);
+          }
+          else if (flags.find('s') != string::npos) {
+            content = naptrContent->getReplacement();
+            DLOG(g_log<<Logger::Debug<<"adding NAPTR replacement 's'="<<content<<endl);
+            B.lookup(QType(QType::SRV), content, d_sd.domain_id, &p);
+            while(B.get(dzr)) {
+              content=getRR<SRVRecordContent>(dzr.dr)->d_target;
+              if(content.isPartOf(d_sd.qname)) {
+                lookup.emplace(content);
+              }
+              dzr.dr.d_place=DNSResourceRecord::ADDITIONAL;
+              r->addRecord(std::move(dzr));
+            }
+            content.clear();
+          }
+          break;
+        }
         default:
           continue;
       }
-      if(content.isPartOf(d_sd.qname)) {
+      if(!content.empty() && content.isPartOf(d_sd.qname)) {
         lookup.emplace(content);
       }
     }
@@ -599,7 +626,6 @@ void PacketHandler::doAdditionalProcessing(DNSPacket& p, std::unique_ptr<DNSPack
     }
   }
 
-  DNSZoneRecord dzr;
   for(const auto& name : lookup) {
     B.lookup(QType(QType::ANY), name, d_sd.domain_id, &p);
     while(B.get(dzr)) {
diff --git a/regression-tests.nobackend/tinydns-data-check/expected_result b/regression-tests.nobackend/tinydns-data-check/expected_result
index c65a7f4d26a4..ecdbff15686e 100644
--- a/regression-tests.nobackend/tinydns-data-check/expected_result
+++ b/regression-tests.nobackend/tinydns-data-check/expected_result
@@ -1,5 +1,5 @@
 f3e86fd522b08d4812505da489ecb5b0  ../regression-tests/zones/example.com
-f8f0d7b157495ec8ee70851e3d5cb65e  ../regression-tests/zones/test.com
+971435ef3a1f47e459c992c5875b4363  ../regression-tests/zones/test.com
 e5e3ee998d151fe194b98997eaa36c53  ../regression-tests/zones/test.dyndns
 dee3e8b568549d9450134b555ca73990  ../regression-tests/zones/sub.test.dyndns
 e7c0fd528e8aaedb1ea3b6daaead4de2  ../regression-tests/zones/wtest.com
@@ -15,5 +15,5 @@ a98864b315f16bcf49ce577426063c42  ../regression-tests/zones/cdnskey-cds-test.com
 9aeed2c26d0c3ba3baf22dfa9568c451  ../regression-tests/zones/2.0.192.in-addr.arpa
 99c73e8b5db5781fec1ac3fa6a2662a9  ../regression-tests/zones/cryptokeys.org
 1f9e19be0cff67330f3a0a5347654f91  ../regression-tests/zones/hiddencryptokeys.org
-16ca9f82f476f5910ed89830dc0f183b  ../modules/tinydnsbackend/data
-022f54332046eb386d636bd9141a4e77  ../modules/tinydnsbackend/data.cdb
+c38877660e9ea3ca06bef9a655373013  ../modules/tinydnsbackend/data
+4bb3554f17c50327ba392cfbe5faaaa3  ../modules/tinydnsbackend/data.cdb
diff --git a/regression-tests/tests/ent-axfr/expected_result b/regression-tests/tests/ent-axfr/expected_result
index 6421d01dbea0..feb1f1aecca1 100644
--- a/regression-tests/tests/ent-axfr/expected_result
+++ b/regression-tests/tests/ent-axfr/expected_result
@@ -5,13 +5,15 @@
 15.order.test.com.	3600	IN	NSEC	server1.test.com. A RRSIG NSEC
 _double._tcp.dc.test.com.	3600	IN	NSEC	_ldap._tcp.dc.test.com. SRV RRSIG NSEC
 _ldap._tcp.dc.test.com.	3600	IN	NSEC	_root._tcp.dc.test.com. SRV RRSIG NSEC
-_root._tcp.dc.test.com.	3600	IN	NSEC	enum.test.com. SRV RRSIG NSEC
+_root._tcp.dc.test.com.	3600	IN	NSEC	enam.test.com. SRV RRSIG NSEC
 _underscore.test.com.	3600	IN	NSEC	aland.test.com. TXT RRSIG NSEC
 aland.test.com.	3600	IN	NSEC	blah.test.com. TXT RRSIG NSEC
 b.c.test.com.	3600	IN	NSEC	*.a.b.c.test.com. A RRSIG NSEC
 blah.test.com.	3600	IN	NSEC	b.c.test.com. NS RRSIG NSEC
 counter.test.com.	3600	IN	NSEC	d.test.com. A RRSIG NSEC
 d.test.com.	3600	IN	NSEC	_double._tcp.dc.test.com. DNAME RRSIG NSEC
+enam.test.com.	3600	IN	NSEC	ensm.test.com. NAPTR RRSIG NSEC
+ensm.test.com.	3600	IN	NSEC	enum.test.com. NAPTR RRSIG NSEC
 enum.test.com.	3600	IN	NSEC	hightxt.test.com. NAPTR RRSIG NSEC
 hightxt.test.com.	3600	IN	NSEC	interrupted-rrset.test.com. TXT RRSIG NSEC SPF
 interrupted-rrset.test.com.	3600	IN	NSEC	ns1.test.com. A TXT RRSIG NSEC
diff --git a/regression-tests/tests/ent-axfr/expected_result.nsec3 b/regression-tests/tests/ent-axfr/expected_result.nsec3
index 1a516046258b..d1db18186165 100644
--- a/regression-tests/tests/ent-axfr/expected_result.nsec3
+++ b/regression-tests/tests/ent-axfr/expected_result.nsec3
@@ -1,4 +1,5 @@
-0bh8di769i8vvtkdds8efjda19abigo5.test.com.	3600	IN	NSEC3	1 0 1 abcd 23E9S542JEHG7KBKNCNJPJHPHUPCD1JE TXT RRSIG SPF
+0bh8di769i8vvtkdds8efjda19abigo5.test.com.	3600	IN	NSEC3	1 0 1 abcd 0POCAINVSVDVCPJNL9NQ2LU1T245OI1A TXT RRSIG SPF
+0pocainvsvdvcpjnl9nq2lu1t245oi1a.test.com.	3600	IN	NSEC3	1 0 1 abcd 23E9S542JEHG7KBKNCNJPJHPHUPCD1JE NAPTR RRSIG
 23e9s542jehg7kbkncnjpjhphupcd1je.test.com.	3600	IN	NSEC3	1 0 1 abcd 2EU2GULBU53H9UVHFALSHPBO2A83T6L2 A RRSIG
 2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.	3600	IN	NSEC3	1 0 1 abcd 2GKS2N3JPQF62QOHAVFQ1PHOLM3HR7RA NS SOA MX RRSIG DNSKEY NSEC3PARAM
 2gks2n3jpqf62qohavfq1pholm3hr7ra.test.com.	3600	IN	NSEC3	1 0 1 abcd 4UL8F3M96VCONEA85U93DH9SG570J4FU TXT RRSIG
@@ -16,7 +17,8 @@ b022o9dksaj737fh77e7kqqtj3om56ki.test.com.	3600	IN	NSEC3	1 0 1 abcd BAE1G74DOIMC
 bae1g74doimcdkg03dafhmgrlh2l19tu.test.com.	3600	IN	NSEC3	1 0 1 abcd CGFU8T55L510A9K688GBO9UACMBBS2AB
 cgfu8t55l510a9k688gbo9uacmbbs2ab.test.com.	3600	IN	NSEC3	1 0 1 abcd DAFC69CV5N2TFCF6OVBVTV94DRGMQJO5 A RRSIG
 dafc69cv5n2tfcf6ovbvtv94drgmqjo5.test.com.	3600	IN	NSEC3	1 0 1 abcd DE592K86U3HEVDJ57JPBT7J5KV7DOO78 TXT RRSIG
-de592k86u3hevdj57jpbt7j5kv7doo78.test.com.	3600	IN	NSEC3	1 0 1 abcd EBAN51BJGUGORB20UNP5PEEC7S5D2EKA NS
+de592k86u3hevdj57jpbt7j5kv7doo78.test.com.	3600	IN	NSEC3	1 0 1 abcd DH5R2B2JT3BB1BP7EUS2I7RS70DTS850 NS
+dh5r2b2jt3bb1bp7eus2i7rs70dts850.test.com.	3600	IN	NSEC3	1 0 1 abcd EBAN51BJGUGORB20UNP5PEEC7S5D2EKA NAPTR RRSIG
 eban51bjgugorb20unp5peec7s5d2eka.test.com.	3600	IN	NSEC3	1 0 1 abcd ENG6HBK77VJMQFVG6S04HAJOA2201LII SRV RRSIG
 eng6hbk77vjmqfvg6s04hajoa2201lii.test.com.	3600	IN	NSEC3	1 0 1 abcd H5855RVON2AASM8QV1NK49I1B2MKBEJP A TXT RRSIG
 h5855rvon2aasm8qv1nk49i1b2mkbejp.test.com.	3600	IN	NSEC3	1 0 1 abcd IAI9HIN25MEH689R5V5GTIFK8OM5DI0E A RRSIG
diff --git a/regression-tests/tests/ent-axfr/expected_result.nsec3-optout b/regression-tests/tests/ent-axfr/expected_result.nsec3-optout
index f56193cb858d..cfec54f6ae2b 100644
--- a/regression-tests/tests/ent-axfr/expected_result.nsec3-optout
+++ b/regression-tests/tests/ent-axfr/expected_result.nsec3-optout
@@ -1,4 +1,5 @@
-0bh8di769i8vvtkdds8efjda19abigo5.test.com.	3600	IN	NSEC3	1 1 1 abcd 23E9S542JEHG7KBKNCNJPJHPHUPCD1JE TXT RRSIG SPF
+0bh8di769i8vvtkdds8efjda19abigo5.test.com.	3600	IN	NSEC3	1 1 1 abcd 0POCAINVSVDVCPJNL9NQ2LU1T245OI1A TXT RRSIG SPF
+0pocainvsvdvcpjnl9nq2lu1t245oi1a.test.com.	3600	IN	NSEC3	1 1 1 abcd 23E9S542JEHG7KBKNCNJPJHPHUPCD1JE NAPTR RRSIG
 23e9s542jehg7kbkncnjpjhphupcd1je.test.com.	3600	IN	NSEC3	1 1 1 abcd 2EU2GULBU53H9UVHFALSHPBO2A83T6L2 A RRSIG
 2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.	3600	IN	NSEC3	1 1 1 abcd 2GKS2N3JPQF62QOHAVFQ1PHOLM3HR7RA NS SOA MX RRSIG DNSKEY NSEC3PARAM
 2gks2n3jpqf62qohavfq1pholm3hr7ra.test.com.	3600	IN	NSEC3	1 1 1 abcd 4UL8F3M96VCONEA85U93DH9SG570J4FU TXT RRSIG
@@ -15,7 +16,8 @@ aovp95mr44hqefrqus6nomsd944bm3vb.test.com.	3600	IN	NSEC3	1 1 1 abcd B022O9DKSAJ7
 b022o9dksaj737fh77e7kqqtj3om56ki.test.com.	3600	IN	NSEC3	1 1 1 abcd BAE1G74DOIMCDKG03DAFHMGRLH2L19TU
 bae1g74doimcdkg03dafhmgrlh2l19tu.test.com.	3600	IN	NSEC3	1 1 1 abcd CGFU8T55L510A9K688GBO9UACMBBS2AB
 cgfu8t55l510a9k688gbo9uacmbbs2ab.test.com.	3600	IN	NSEC3	1 1 1 abcd DAFC69CV5N2TFCF6OVBVTV94DRGMQJO5 A RRSIG
-dafc69cv5n2tfcf6ovbvtv94drgmqjo5.test.com.	3600	IN	NSEC3	1 1 1 abcd EBAN51BJGUGORB20UNP5PEEC7S5D2EKA TXT RRSIG
+dafc69cv5n2tfcf6ovbvtv94drgmqjo5.test.com.	3600	IN	NSEC3	1 1 1 abcd DH5R2B2JT3BB1BP7EUS2I7RS70DTS850 TXT RRSIG
+dh5r2b2jt3bb1bp7eus2i7rs70dts850.test.com.	3600	IN	NSEC3	1 1 1 abcd EBAN51BJGUGORB20UNP5PEEC7S5D2EKA NAPTR RRSIG
 eban51bjgugorb20unp5peec7s5d2eka.test.com.	3600	IN	NSEC3	1 1 1 abcd ENG6HBK77VJMQFVG6S04HAJOA2201LII SRV RRSIG
 eng6hbk77vjmqfvg6s04hajoa2201lii.test.com.	3600	IN	NSEC3	1 1 1 abcd H5855RVON2AASM8QV1NK49I1B2MKBEJP A TXT RRSIG
 h5855rvon2aasm8qv1nk49i1b2mkbejp.test.com.	3600	IN	NSEC3	1 1 1 abcd IAI9HIN25MEH689R5V5GTIFK8OM5DI0E A RRSIG
diff --git a/regression-tests/tests/naptr/command b/regression-tests/tests/naptr/command
index 1a367cfaf424..0da7367864a5 100755
--- a/regression-tests/tests/naptr/command
+++ b/regression-tests/tests/naptr/command
@@ -1,3 +1,4 @@
 #!/bin/sh
 cleandig enum.test.com NAPTR
-
+cleandig ensm.test.com NAPTR
+cleandig enam.test.com NAPTR
diff --git a/regression-tests/tests/naptr/expected_result b/regression-tests/tests/naptr/expected_result
index 4a4aa625613d..9ed15187f850 100644
--- a/regression-tests/tests/naptr/expected_result
+++ b/regression-tests/tests/naptr/expected_result
@@ -1,3 +1,13 @@
-0	enum.test.com.	3600	IN	NAPTR	100 50 "u" "e2u+sip" "" testuser.domain.com.
+0	enum.test.com.	3600	IN	NAPTR	100 50 "u" "e2u+sip" "" server1.test.com.
 Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='enum.test.com.', qtype=NAPTR
+0	ensm.test.com.	3600	IN	NAPTR	100 50 "s" "e2u+sip" "" _double._tcp.dc.test.com.
+2	_double._tcp.dc.test.com.	3600	IN	SRV	0 100 389 server1.test.com.
+2	_double._tcp.dc.test.com.	3600	IN	SRV	1 100 389 server1.test.com.
+2	server1.test.com.	3600	IN	A	1.2.3.4
+Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
+Reply to question for qname='ensm.test.com.', qtype=NAPTR
+0	enam.test.com.	3600	IN	NAPTR	100 50 "a" "e2u+sip" "" server1.test.com.
+2	server1.test.com.	3600	IN	A	1.2.3.4
+Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
+Reply to question for qname='enam.test.com.', qtype=NAPTR
diff --git a/regression-tests/zones/test.com b/regression-tests/zones/test.com
index f3adcb1fe7ed..dd32a827c661 100644
--- a/regression-tests/zones/test.com
+++ b/regression-tests/zones/test.com
@@ -20,7 +20,9 @@ server1			IN	A	1.2.3.4
 *.test			IN	CNAME	server1
 www.test		IN	A	4.3.2.1
 sub.test		IN	NS	ns-test.example.net
-enum			IN	NAPTR 100 50 "u" "e2u+sip" "" testuser.domain.com.
+enum			IN	NAPTR 100 50 "u" "e2u+sip" "" server1.test.com.
+ensm			IN	NAPTR 100 50 "s" "e2u+sip" "" _double._tcp.dc.test.com.
+enam			IN	NAPTR 100 50 "a" "e2u+sip" "" server1.test.com.
 counter			IN	A	1.1.1.5
 _ldap._tcp.dc		IN	SRV 	0 100 389 server2.example.net.
 _double._tcp.dc		IN	SRV 	0 100 389 server1