diff --git a/bind.spec b/bind.spec
index 79e961e..e0522c6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -31,6 +31,7 @@
 %else
 %bcond_with    UNITTEST
 %endif
+%bcond_with    TSAN
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -244,6 +245,9 @@ BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
 BuildRequires: docbook-style-xsl, libxslt
+%if %{with TSAN}
+BuildRequires: libtsan
+%endif
 
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@@ -643,10 +647,15 @@ done
   cp -Tuav bin/tests "%{1}/bin/tests/" \
   cp -uv version "%{1}" \
 
-export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with TSAN}
+  CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
+%endif
+export CFLAGS
 export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"
 export STD_CDEFINES="$CPPFLAGS"
 
+
 sed -i -e \
 's/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \
 version
@@ -850,6 +859,10 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
   eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif
 
+%if %{with TSAN}
+export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
+%endif
+
 %if %{with UNITTEST}
   pushd build
   make unit