diff --git a/servers/slapd/add.c b/servers/slapd/add.c
index 9399d5d4a0..f0d75237ff 100644
--- a/servers/slapd/add.c
+++ b/servers/slapd/add.c
@@ -34,7 +34,7 @@ int
 do_add( Connection *conn, Operation *op )
 {
 	BerElement	*ber = op->o_ber;
-	char		*dn, *ndn, *last;
+	char		*dn, *last;
 	ber_len_t	len;
 	ber_tag_t	tag;
 	Entry		*e;
@@ -68,7 +68,7 @@ do_add( Connection *conn, Operation *op )
 	if ( ber_scanf( ber, "{a", /*}*/ &dn ) == LBER_ERROR ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-			   "do_add: conn %d ber_scanf failed\n", conn->c_connid ));
+			"do_add: conn %d ber_scanf failed\n", conn->c_connid ));
 #else
 		Debug( LDAP_DEBUG_ANY, "do_add: ber_scanf failed\n", 0, 0, 0 );
 #endif
@@ -77,32 +77,28 @@ do_add( Connection *conn, Operation *op )
 		return -1;
 	}
 
-	ndn = ch_strdup( dn );
-
-	if ( dn_normalize( ndn ) == NULL ) {
-#ifdef NEW_LOGGING
-		LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-			   "do_add: conn %d	 invalid dn (%s)\n", conn->c_connid, dn ));
-#else
-		Debug( LDAP_DEBUG_ANY, "do_add: invalid dn (%s)\n", dn, 0, 0 );
-#endif
-		send_ldap_result( conn, op, LDAP_INVALID_DN_SYNTAX, NULL,
-		    "invalid DN", NULL, NULL );
-		free( dn );
-		free( ndn );
-		return LDAP_INVALID_DN_SYNTAX;
-	}
-
 	e = (Entry *) ch_calloc( 1, sizeof(Entry) );
 
-	e->e_dn = dn;
-	e->e_ndn = ndn;
+	e->e_dn = dn_pretty( dn );
+	e->e_ndn = dn_normalize( dn );
 	e->e_attrs = NULL;
 	e->e_private = NULL;
 
+	if ( e->e_ndn == NULL ) {
+#ifdef NEW_LOGGING
+		LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
+			"do_add: conn %d	 invalid dn (%s)\n", conn->c_connid, dn ));
+#else
+		Debug( LDAP_DEBUG_ANY, "do_add: invalid dn (%s)\n", dn, 0, 0 );
+#endif
+		send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
+		    "invalid DN", NULL, NULL );
+		goto done;
+	}
+
 #ifdef NEW_LOGGING
 	LDAP_LOG(( "operation", LDAP_LEVEL_ARGS,
-		   "do_add: conn %d  ndn (%s)\n", conn->c_connid, e->e_ndn ));
+		"do_add: conn %d  ndn (%s)\n", conn->c_connid, e->e_ndn ));
 #else
 	Debug( LDAP_DEBUG_ARGS, "do_add: ndn (%s)\n", e->e_ndn, 0, 0 );
 #endif
@@ -191,7 +187,7 @@ do_add( Connection *conn, Operation *op )
 		goto done;
 
 #if defined( SLAPD_SCHEMA_DN )
-	} else if ( strcasecmp( ndn, SLAPD_SCHEMA_DN ) == 0 ) {
+	} else if ( strcasecmp( e->e_ndn, SLAPD_SCHEMA_DN ) == 0 ) {
 		/* protocolError may be a more appropriate error */
 		send_ldap_result( conn, op, rc = LDAP_ALREADY_EXISTS,
 			NULL, "subschema subentry already exists",
diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c
index 9117641293..07f5fbe200 100644
--- a/servers/slapd/dn.c
+++ b/servers/slapd/dn.c
@@ -28,6 +28,23 @@
 #define INQUOTEDVALUE	7
 #define B4SEPARATOR		8
 
+/*
+ * dn_pretty - "pretty" the DN
+ */
+char *dn_pretty( const char *dn_in )
+{
+	/*
+	 * dn_validate based implementation (for now)
+	 *	likely better just to zap this, dn_validate, dn_normalize
+	 */
+	char *dn, *dn_out;
+
+	dn = ch_strdup( dn_in );
+	dn_out = dn_validate( dn );
+	if( dn_out == NULL ) free( dn );
+	return dn_out;
+}
+
 /*
  * dn_validate - validate and compress dn.  the dn is
  * compressed in place are returned if valid.
@@ -302,8 +319,7 @@ dn_match( const char *val, const char *asserted )
 char *
 dn_parent(
 	Backend	*be,
-	const char	*dn
-)
+	const char	*dn )
 {
 	const char	*s;
 	int	inquote;
diff --git a/servers/slapd/entry.c b/servers/slapd/entry.c
index ccb773a5a7..3608eeaefb 100644
--- a/servers/slapd/entry.c
+++ b/servers/slapd/entry.c
@@ -266,12 +266,28 @@ str2entry( char *s )
 	}
 
 	/* generate normalized dn */
-	e->e_ndn = ch_strdup( e->e_dn );
+	e->e_ndn = e->e_dn;
+	e->e_dn = dn_pretty( e->e_dn );
+
+	if( e->e_dn == NULL ) {
+#ifdef NEW_LOGGING
+		LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+			   "str2entry:  entry %ld has invalid dn: %s\n",
+				(long) e->e_id, e->e_ndn ));
+#else
+		Debug( LDAP_DEBUG_ANY,
+			"str2entry: entry %ld has invalid dn: %s\n",
+		    (long) e->e_id, e->e_ndn, 0 );
+#endif
+		entry_free( e );
+		return( NULL );
+	}
+
 	(void) dn_normalize( e->e_ndn );
 
 #ifdef NEW_LOGGING
 	LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL2,
-		   "str2entry(%s) -> 0x%lx\n", e->e_dn, (unsigned long)e ));
+		"str2entry(%s) -> 0x%lx\n", e->e_dn, (unsigned long)e ));
 #else
 	Debug(LDAP_DEBUG_TRACE, "<= str2entry(%s) -> 0x%lx\n",
 		e->e_dn, (unsigned long) e, 0 );
diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index 282dd08357..8b3539f745 100644
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -314,6 +314,7 @@ LDAP_SLAPD_F (void) connection_internal_close( Connection *conn );
  * dn.c
  */
 
+LDAP_SLAPD_F (char *) dn_pretty LDAP_P(( const char *dn ));
 LDAP_SLAPD_F (char *) dn_validate LDAP_P(( char *dn ));
 LDAP_SLAPD_F (char *) dn_normalize LDAP_P(( char *dn ));
 LDAP_SLAPD_F (int) dn_match LDAP_P(( const char *val, const char *asserted ));