diff --git a/dlls/dnsapi/libresolv.c b/dlls/dnsapi/libresolv.c
index 197ca84aeae..e5c520a0a32 100644
--- a/dlls/dnsapi/libresolv.c
+++ b/dlls/dnsapi/libresolv.c
@@ -581,6 +581,7 @@ static DNS_STATUS copy_rdata( ns_msg msg, const ns_rr *rr, DNS_RECORDA *r, WORD
         r->Data.KEY.chAlgorithm = *pos++;
 
         size = rr->rdata + rr->rdlength - pos;
+        r->Data.KEY.wKeyLength = size;
 
         for (i = 0; i < size; i++)
             r->Data.KEY.Key[i] = *pos++;
@@ -668,6 +669,7 @@ static DNS_STATUS copy_rdata( ns_msg msg, const ns_rr *rr, DNS_RECORDA *r, WORD
         r->Data.SIG.wKeyTag       = *(const WORD *)pos;
 
         size = rr->rdata + rr->rdlength - pos;
+        r->Data.SIG.wSignatureLength = size;
 
         for (i = 0; i < size; i++)
             r->Data.SIG.Signature[i] = *pos++;
diff --git a/dlls/dnsapi/record.c b/dlls/dnsapi/record.c
index 5a75503d892..014d788cf5e 100644
--- a/dlls/dnsapi/record.c
+++ b/dlls/dnsapi/record.c
@@ -221,10 +221,10 @@ BOOL WINAPI DnsRecordCompare( PDNS_RECORD r1, PDNS_RECORD r2 )
     {
         if (r1->Data.KEY.wFlags      != r2->Data.KEY.wFlags      ||
             r1->Data.KEY.chProtocol  != r2->Data.KEY.chProtocol  ||
-            r1->Data.KEY.chAlgorithm != r2->Data.KEY.chAlgorithm)
+            r1->Data.KEY.chAlgorithm != r2->Data.KEY.chAlgorithm ||
+            r1->Data.KEY.wKeyLength  != r2->Data.KEY.wKeyLength)
             return FALSE;
-        if (memcmp( r1->Data.KEY.Key, r2->Data.KEY.Key,
-                    r1->wDataLength - sizeof(DNS_KEY_DATA) + 1 ))
+        if (memcmp( r1->Data.KEY.Key, r2->Data.KEY.Key, r1->Data.KEY.wKeyLength ))
             return FALSE;
         break;
     }
@@ -238,10 +238,10 @@ BOOL WINAPI DnsRecordCompare( PDNS_RECORD r1, PDNS_RECORD r2 )
             r1->Data.SIG.dwOriginalTtl != r2->Data.SIG.dwOriginalTtl ||
             r1->Data.SIG.dwExpiration  != r2->Data.SIG.dwExpiration  ||
             r1->Data.SIG.dwTimeSigned  != r2->Data.SIG.dwTimeSigned  ||
-            r1->Data.SIG.wKeyTag       != r2->Data.SIG.wKeyTag)
+            r1->Data.SIG.wKeyTag       != r2->Data.SIG.wKeyTag       ||
+            r1->Data.SIG.wSignatureLength != r2->Data.SIG.wSignatureLength)
             return FALSE;
-        if (memcmp( r1->Data.SIG.Signature, r2->Data.SIG.Signature,
-                    r1->wDataLength - sizeof(DNS_SIG_DATAA) + 1 ))
+        if (memcmp( r1->Data.SIG.Signature, r2->Data.SIG.Signature, r1->Data.SIG.wSignatureLength ))
             return FALSE;
         break;
     }
diff --git a/include/windns.h b/include/windns.h
index f1f2184281c..9796a299d04 100644
--- a/include/windns.h
+++ b/include/windns.h
@@ -339,6 +339,8 @@ typedef struct
     WORD wFlags;
     BYTE chProtocol;
     BYTE chAlgorithm;
+    WORD wKeyLength;
+    WORD wPad;
     BYTE Key[1];
 } DNS_KEY_DATA, *PDNS_KEY_DATA;
 
@@ -355,7 +357,6 @@ typedef struct
 
 typedef struct
 {
-    PSTR pNameSigner;
     WORD wTypeCovered;
     BYTE chAlgorithm;
     BYTE chLabelCount;
@@ -363,13 +364,13 @@ typedef struct
     DWORD dwExpiration;
     DWORD dwTimeSigned;
     WORD wKeyTag;
-    WORD Pad;
+    WORD wSignatureLength;
+    PSTR pNameSigner;
     BYTE Signature[1];
 } DNS_SIG_DATAA, *PDNS_SIG_DATAA;
 
 typedef struct
 {
-    PWSTR pNameSigner;
     WORD wTypeCovered;
     BYTE chAlgorithm;
     BYTE chLabelCount;
@@ -377,7 +378,8 @@ typedef struct
     DWORD dwExpiration;
     DWORD dwTimeSigned;
     WORD wKeyTag;
-    WORD Pad;
+    WORD wSignatureLength;
+    PWSTR pNameSigner;
     BYTE Signature[1];
 } DNS_SIG_DATAW, *PDNS_SIG_DATAW;