diff --git a/dnssec-tools/tools/modules/ZoneFile-Fast/Fast.pm b/dnssec-tools/tools/modules/ZoneFile-Fast/Fast.pm
index db99379..54333d5 100644
--- a/dnssec-tools/tools/modules/ZoneFile-Fast/Fast.pm
+++ b/dnssec-tools/tools/modules/ZoneFile-Fast/Fast.pm
@@ -1310,8 +1310,10 @@ sub parse_tlsa
   {
       # got more data
       if (/\)\s*$/) {
-	  if (/\G\s*(\S*)\s*\)\s*$/gc) {
+	  while (/\G\s*([0-9A-Za-z]+)\s*/gc) {
 	      $tlsa->{'cert'} .= $1;
+	  }
+	  if (/\G\s*\)$/gc) {
 	      $tlsa->{'cert'} = lc($tlsa->{'cert'});
 
 	      # we're done
@@ -1321,7 +1323,7 @@ sub parse_tlsa
 	      push @zone, $tlsa;
 	      $tlsa = undef;
 	  } else {
-	      error("bad tlsa last line");
+	      error("bad tlsa last line: $_");
 	  }
       } else {
 	  if (/\G\s*(\S+)\s*$/gc) {
diff --git a/dnssec-tools/tools/modules/ZoneFile-Fast/t/rrs.t b/dnssec-tools/tools/modules/ZoneFile-Fast/t/rrs.t
index 2539b1c..af6cc00 100644
--- a/dnssec-tools/tools/modules/ZoneFile-Fast/t/rrs.t
+++ b/dnssec-tools/tools/modules/ZoneFile-Fast/t/rrs.t
@@ -65,7 +65,10 @@ BEGIN {
 	 );
 
     if ($Net::DNS::VERSION > 0.72) {
-	push @test, 	 q{acme.com. IN TLSA 3 0 1 1BFC4290C5798EFCC6D4A1F2D79C3C5F49ACCAC687DF42974B68A45F 05BA074F},
+	    push @test, 	 q{acme.com. IN TLSA 3 0 1 1BFC4290C5798EFCC6D4A1F2D79C3C5F49ACCAC687DF42974B68A45F 05BA074F};
+	    push @test, 	 q{acme.com. IN TLSA 3 0 1 ( 1BFC4290C5798EFCC6D4A1F2D79C3C5F49ACCAC687DF42974B68A45F 05BA074F )};
+	    push @test, 	 q{acme.com. IN TLSA 3 0 1 (
+                1BFC4290C5798EFCC6D4A1F2D79C3C5F49ACCAC687DF42974B68A45F 05BA074F )};
     }
 }