diff --git a/pkg/apis/externaldns/types.go b/pkg/apis/externaldns/types.go
index f559c84d52..92e49e3800 100644
--- a/pkg/apis/externaldns/types.go
+++ b/pkg/apis/externaldns/types.go
@@ -166,7 +166,7 @@ type Config struct {
 	RFC2136GSSTSIG                    bool
 	RFC2136KerberosRealm              string
 	RFC2136KerberosUsername           string
-	RFC2136KerberosPassword           string
+	RFC2136KerberosPassword           string `secure:"yes"`
 	RFC2136TSIGKeyName                string
 	RFC2136TSIGSecret                 string `secure:"yes"`
 	RFC2136TSIGSecretAlg              string