diff --git a/docs/guides/basic-database.rst b/docs/guides/basic-database.rst
index 15afac0091a2..8afb554820b2 100644
--- a/docs/guides/basic-database.rst
+++ b/docs/guides/basic-database.rst
@@ -67,7 +67,7 @@ Now, let's add a zone and some records::
     $ sudo -u pdns pdnsutil create-zone example.com ns1.example.com
     Creating empty zone 'example.com'
     Also adding one NS record
-    $ sudo -u pdns pdnsutil add-record example.com '' MX '25 mail.example.com'
+    $ sudo -u pdns pdnsutil add-record example.com @ MX '25 mail.example.com'
     New rrset:
     example.com. 3005 IN MX 25 mail.example.com
     $ sudo -u pdns pdnsutil add-record example.com. www A 192.0.2.1
diff --git a/docs/manpages/pdnsutil.1.rst b/docs/manpages/pdnsutil.1.rst
index dfc8e01c6030..4a2f9183b0cd 100644
--- a/docs/manpages/pdnsutil.1.rst
+++ b/docs/manpages/pdnsutil.1.rst
@@ -172,6 +172,7 @@ ZONE MANIPULATION COMMANDS
 add-record *ZONE* *NAME* *TYPE* [*TTL*] *CONTENT*
     Add one or more records of *NAME* and *TYPE* to *ZONE* with *CONTENT*
     and optional *TTL*. If *TTL* is not set, default will be used.
+    Use @ as name to add a record to the apex.
 add-autoprimary *IP* *NAMESERVER* [*ACCOUNT*]
     Add a autoprimary entry into the backend. This enables receiving zone updates from other servers.
 remove-autoprimary *IP* *NAMESERVER*
diff --git a/pdns/misc.hh b/pdns/misc.hh
index 39fdb6c08680..2a7c0be2a2bf 100644
--- a/pdns/misc.hh
+++ b/pdns/misc.hh
@@ -469,9 +469,7 @@ pair<string, string> splitField(const string& inp, char sepa);
 
 inline bool isCanonical(const string& qname)
 {
-  if(qname.empty())
-    return false;
-  return qname[qname.size()-1]=='.';
+  return boost::ends_with(qname, ".");
 }
 
 inline DNSName toCanonic(const DNSName& zone, const string& qname)
diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index ed19662297cd..92d010b0d786 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -1597,10 +1597,14 @@ static int addOrReplaceRecord(bool addOrReplace, const vector<string>& cmds) {
   vector<DNSResourceRecord> newrrs;
   DNSName zone(cmds.at(1));
   DNSName name;
-  if (cmds.at(2) == "@")
-    name=zone;
-  else
+  if (cmds.at(2) == "@") {
+    name = zone;
+  } else if (isCanonical(cmds.at(2)) || boost::ends_with(cmds.at(2), cmds.at(1))) {
+    name = DNSName(cmds.at(2));
+  } else {
+    cerr << "Name " << cmds.at(2) << "' does not fit into zone '" << zone << "'. Interpreting as relative name." << endl;
     name = DNSName(cmds.at(2)) + zone;
+  }
 
   rr.qtype = DNSRecordContent::TypeToNumber(cmds.at(3));
   rr.ttl = ::arg().asNum("default-ttl");
@@ -1735,10 +1739,14 @@ static int deleteRRSet(const std::string& zone_, const std::string& name_, const
   }
 
   DNSName name;
-  if(name_=="@")
-    name=zone;
-  else
-    name=DNSName(name_)+zone;
+  if (name_ == "@") {
+    name = zone;
+  } else if (isCanonical(name_) || boost::ends_with(name_, zone_)) {
+    name = DNSName(name_);
+  } else {
+    cerr << "Name " << name_ << "' does not fit into zone '" << zone << "'. Interpreting as relative name." << endl;
+    name = DNSName(name_) + zone;
+  }
 
   QType qt(QType::chartocode(type_.c_str()));
   di.backend->startTransaction(zone, -1);
diff --git a/regression-tests.auth-py/test_GSSTSIG.py b/regression-tests.auth-py/test_GSSTSIG.py
index 2297f46c2a98..5b388efa0488 100644
--- a/regression-tests.auth-py/test_GSSTSIG.py
+++ b/regression-tests.auth-py/test_GSSTSIG.py
@@ -43,9 +43,9 @@ def setUpClass(cls):
         os.system("$PDNSUTIL --config-dir=configs/auth create-zone noacceptor.net")
         os.system("$PDNSUTIL --config-dir=configs/auth create-zone wrongacceptor.net")
 
-        os.system("$PDNSUTIL --config-dir=configs/auth add-record example.net . SOA 3600 'ns1.example.net otto.example.net 2022010403 10800 3600 604800 3600'")
-        os.system("$PDNSUTIL --config-dir=configs/auth add-record noacceptor.net . SOA 3600 'ns1.noacceptor.net otto.example.net 2022010403 10800 3600 604800 3600'")
-        os.system("$PDNSUTIL --config-dir=configs/auth add-record wrongacceptor.net . SOA 3600 'ns1.wrongacceptor.net otto.example.net 2022010403 10800 3600 604800 3600'")
+        os.system("$PDNSUTIL --config-dir=configs/auth add-record example.net @ SOA 3600 'ns1.example.net otto.example.net 2022010403 10800 3600 604800 3600'")
+        os.system("$PDNSUTIL --config-dir=configs/auth add-record noacceptor.net @ SOA 3600 'ns1.noacceptor.net otto.example.net 2022010403 10800 3600 604800 3600'")
+        os.system("$PDNSUTIL --config-dir=configs/auth add-record wrongacceptor.net @ SOA 3600 'ns1.wrongacceptor.net otto.example.net 2022010403 10800 3600 604800 3600'")
 
         os.system("$PDNSUTIL --config-dir=configs/auth set-meta example.net GSS-ACCEPTOR-PRINCIPAL DNS/ns1.example.net@EXAMPLE.COM")
         os.system("$PDNSUTIL --config-dir=configs/auth set-meta wrongacceptor.net GSS-ACCEPTOR-PRINCIPAL DNS/ns1.example.net@EXAMPLE.COM")