diff --git a/src/dns/nm-dns-dnsmasq.c b/src/dns/nm-dns-dnsmasq.c
index c57522bf87..ce89b07865 100644
--- a/src/dns/nm-dns-dnsmasq.c
+++ b/src/dns/nm-dns-dnsmasq.c
@@ -365,7 +365,8 @@ static gboolean
 update (NMDnsPlugin *plugin,
         const NMGlobalDnsConfig *global_config,
         const CList *ip_config_lst_head,
-        const char *hostname)
+        const char *hostname,
+        GError **error)
 {
 	NMDnsDnsmasq *self = NM_DNS_DNSMASQ (plugin);
 	NMDnsDnsmasqPrivate *priv = NM_DNS_DNSMASQ_GET_PRIVATE (self);
diff --git a/src/dns/nm-dns-manager.c b/src/dns/nm-dns-manager.c
index 1d009c98f5..d798c66097 100644
--- a/src/dns/nm-dns-manager.c
+++ b/src/dns/nm-dns-manager.c
@@ -1428,13 +1428,15 @@ update_dns (NMDnsManager *self,
 		nm_dns_plugin_update (priv->sd_resolve_plugin,
 		                      global_config,
 		                      _ip_config_lst_head (self),
-		                      priv->hostname);
+		                      priv->hostname,
+		                      NULL);
 	}
 
 	/* Let any plugins do their thing first */
 	if (priv->plugin) {
 		NMDnsPlugin *plugin = priv->plugin;
 		const char *plugin_name = nm_dns_plugin_get_name (plugin);
+		gs_free_error GError *plugin_error = NULL;
 
 		if (nm_dns_plugin_is_caching (plugin)) {
 			if (no_caching) {
@@ -1449,8 +1451,9 @@ update_dns (NMDnsManager *self,
 		if (!nm_dns_plugin_update (plugin,
 		                           global_config,
 		                           _ip_config_lst_head (self),
-		                           priv->hostname)) {
-			_LOGW ("update-dns: plugin %s update failed", plugin_name);
+		                           priv->hostname,
+		                           &plugin_error)) {
+			_LOGW ("update-dns: plugin %s update failed: %s", plugin_name, plugin_error->message);
 
 			/* If the plugin failed to update, we shouldn't write out a local
 			 * caching DNS configuration to resolv.conf.
diff --git a/src/dns/nm-dns-plugin.c b/src/dns/nm-dns-plugin.c
index 62488a454e..9ca7392f56 100644
--- a/src/dns/nm-dns-plugin.c
+++ b/src/dns/nm-dns-plugin.c
@@ -64,14 +64,16 @@ gboolean
 nm_dns_plugin_update (NMDnsPlugin *self,
                       const NMGlobalDnsConfig *global_config,
                       const CList *ip_config_lst_head,
-                      const char *hostname)
+                      const char *hostname,
+                      GError **error)
 {
 	g_return_val_if_fail (NM_DNS_PLUGIN_GET_CLASS (self)->update != NULL, FALSE);
 
 	return NM_DNS_PLUGIN_GET_CLASS (self)->update (self,
 	                                               global_config,
 	                                               ip_config_lst_head,
-	                                               hostname);
+	                                               hostname,
+	                                               error);
 }
 
 gboolean
diff --git a/src/dns/nm-dns-plugin.h b/src/dns/nm-dns-plugin.h
index 286a4fb196..1a12c8d928 100644
--- a/src/dns/nm-dns-plugin.h
+++ b/src/dns/nm-dns-plugin.h
@@ -36,7 +36,8 @@ typedef struct {
 	gboolean (*update) (NMDnsPlugin *self,
 	                    const NMGlobalDnsConfig *global_config,
 	                    const CList *ip_config_lst_head,
-	                    const char *hostname);
+	                    const char *hostname,
+	                    GError **error);
 
 	const char *plugin_name;
 
@@ -64,7 +65,8 @@ const char *nm_dns_plugin_get_name (NMDnsPlugin *self);
 gboolean nm_dns_plugin_update (NMDnsPlugin *self,
                                const NMGlobalDnsConfig *global_config,
                                const CList *ip_config_lst_head,
-                               const char *hostname);
+                               const char *hostname,
+                               GError **error);
 
 void nm_dns_plugin_stop (NMDnsPlugin *self);
 
diff --git a/src/dns/nm-dns-systemd-resolved.c b/src/dns/nm-dns-systemd-resolved.c
index c9fb773f52..04b8012997 100644
--- a/src/dns/nm-dns-systemd-resolved.c
+++ b/src/dns/nm-dns-systemd-resolved.c
@@ -338,7 +338,8 @@ static gboolean
 update (NMDnsPlugin *plugin,
         const NMGlobalDnsConfig *global_config,
         const CList *ip_config_lst_head,
-        const char *hostname)
+        const char *hostname,
+        GError **error)
 {
 	NMDnsSystemdResolved *self = NM_DNS_SYSTEMD_RESOLVED (plugin);
 	gs_unref_hashtable GHashTable *interfaces = NULL;
diff --git a/src/dns/nm-dns-unbound.c b/src/dns/nm-dns-unbound.c
index e9515ba351..3884ce9a51 100644
--- a/src/dns/nm-dns-unbound.c
+++ b/src/dns/nm-dns-unbound.c
@@ -27,9 +27,11 @@ static gboolean
 update (NMDnsPlugin *plugin,
         const NMGlobalDnsConfig *global_config,
         const CList *ip_config_lst_head,
-        const char *hostname)
+        const char *hostname,
+        GError **error)
 {
 	char *argv[] = { DNSSEC_TRIGGER_PATH, "--async", "--update", NULL };
+	gs_free_error GError *local = NULL;
 	int status;
 
 	/* TODO: We currently call a script installed with the dnssec-trigger
@@ -41,9 +43,19 @@ update (NMDnsPlugin *plugin,
 	 * without calling custom scripts. The dnssec-trigger functionality
 	 * may be eventually merged into NetworkManager.
 	 */
-	if (!g_spawn_sync ("/", argv, NULL, 0, NULL, NULL, NULL, NULL, &status, NULL))
+	if (!g_spawn_sync ("/", argv, NULL, 0, NULL, NULL, NULL, NULL, &status, &local)) {
+		nm_utils_error_set (error, NM_UTILS_ERROR_UNKNOWN,
+		                    "error spawning dns-trigger: %s",
+		                    local->message);
 		return FALSE;
-	return (status == 0);
+	}
+	if (status != 0) {
+		nm_utils_error_set (error, NM_UTILS_ERROR_UNKNOWN,
+		                    "dns-trigger exited with error code %d",
+		                    status);
+		return FALSE;
+	}
+	return TRUE;
 }
 
 /*****************************************************************************/