diff --git a/plugin/cache/dnssec.go b/plugin/cache/dnssec.go
index 7f880db75..61a1cc15f 100644
--- a/plugin/cache/dnssec.go
+++ b/plugin/cache/dnssec.go
@@ -4,7 +4,7 @@ import "github.com/miekg/dns"
 
 // isDNSSEC returns true if r is a DNSSEC record. NSEC,NSEC3,DS and RRSIG/SIG
 // are DNSSEC records. DNSKEYs is not in this list on the assumption that the
-// client explictly asked for it.
+// client explicitly asked for it.
 func isDNSSEC(r dns.RR) bool {
 	switch r.Header().Rrtype {
 	case dns.TypeNSEC:
diff --git a/plugin/dnstap/handler_test.go b/plugin/dnstap/handler_test.go
index acfbc8770..e8a0d7020 100644
--- a/plugin/dnstap/handler_test.go
+++ b/plugin/dnstap/handler_test.go
@@ -42,10 +42,10 @@ func (w *writer) Dnstap(e tap.Dnstap) {
 	got := e.Message
 
 	if string(ex.QueryAddress) != string(got.QueryAddress) {
-		w.t.Errorf("Expected source adress %s, got %s", ex.QueryAddress, got.QueryAddress)
+		w.t.Errorf("Expected source address %s, got %s", ex.QueryAddress, got.QueryAddress)
 	}
 	if string(ex.ResponseAddress) != string(got.ResponseAddress) {
-		w.t.Errorf("Expected response adress %s, got %s", ex.ResponseAddress, got.ResponseAddress)
+		w.t.Errorf("Expected response address %s, got %s", ex.ResponseAddress, got.ResponseAddress)
 	}
 	if *ex.QueryPort != *got.QueryPort {
 		w.t.Errorf("Expected port %d, got %d", *ex.QueryPort, *got.QueryPort)