diff --git a/plugin/cache/dnssec.go b/plugin/cache/dnssec.go
index ec5ff41cb..da7e1e9b3 100644
--- a/plugin/cache/dnssec.go
+++ b/plugin/cache/dnssec.go
@@ -3,8 +3,8 @@ package cache
 import "github.com/miekg/dns"
 
 // filterRRSlice filters out OPT RRs, and sets all RR TTLs to ttl.
-// If dup is true the RRs in rrs are _copied_ into the slice that is
-// returned.
+// If dup is true the RRs in rrs are _copied_ before adjusting their
+// TTL and the slice of copied RRs is returned.
 func filterRRSlice(rrs []dns.RR, ttl uint32, dup bool) []dns.RR {
 	j := 0
 	rs := make([]dns.RR, len(rrs))
@@ -12,12 +12,12 @@ func filterRRSlice(rrs []dns.RR, ttl uint32, dup bool) []dns.RR {
 		if r.Header().Rrtype == dns.TypeOPT {
 			continue
 		}
-		r.Header().Ttl = ttl
 		if dup {
 			rs[j] = dns.Copy(r)
 		} else {
 			rs[j] = r
 		}
+		rs[j].Header().Ttl = ttl
 		j++
 	}
 	return rs[:j]