diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 9bab35cd2..13c7a4980 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -333,7 +333,7 @@ _kdc_find_etype(astgs_request_t r, uint32_t flags,
 	}
     }
 
-    if (enctype == ETYPE_NULL) {
+    if (ret == 0 && enctype == ETYPE_NULL) {
         /*
          * if the service principal is one for which there is a known 1DES
          * exception and no other enctype matches both the client request and