diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index 4d2400dc10..fc84c579ae 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -402,6 +402,9 @@ Release 2.7.0 - UNRELEASED
     HDFS-7242. Code improvement for FSN#checkUnreadableBySuperuser.
     (Yi Liu via vinayakumarb)
 
+    HDFS-7252. small refinement to the use of isInAnEZ in FSNamesystem.
+    (Yi Liu via vinayakumarb)
+
 Release 2.6.0 - UNRELEASED
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java
index 82d5c0e152..8e1ea7934c 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java
@@ -2592,11 +2592,11 @@ private HdfsFileStatus startFileInt(final String srcArg,
         src = resolvePath(src, pathComponents);
         INodesInPath iip = dir.getINodesInPath4Write(src);
         // Nothing to do if the path is not within an EZ
-        if (dir.isInAnEZ(iip)) {
-          EncryptionZone zone = dir.getEZForPath(iip);
+        final EncryptionZone zone = dir.getEZForPath(iip);
+        if (zone != null) {
           protocolVersion = chooseProtocolVersion(zone, supportedVersions);
           suite = zone.getSuite();
-          ezKeyName = dir.getKeyName(iip);
+          ezKeyName = zone.getKeyName();
 
           Preconditions.checkNotNull(protocolVersion);
           Preconditions.checkNotNull(suite);
@@ -2679,14 +2679,16 @@ private BlocksMapUpdateInfo startFileInternal(FSPermissionChecker pc,
     }
 
     FileEncryptionInfo feInfo = null;
-    if (dir.isInAnEZ(iip)) {
+
+    final EncryptionZone zone = dir.getEZForPath(iip);
+    if (zone != null) {
       // The path is now within an EZ, but we're missing encryption parameters
       if (suite == null || edek == null) {
         throw new RetryStartFileException();
       }
       // Path is within an EZ and we have provided encryption parameters.
       // Make sure that the generated EDEK matches the settings of the EZ.
-      String ezKeyName = dir.getKeyName(iip);
+      final String ezKeyName = zone.getKeyName();
       if (!ezKeyName.equals(edek.getEncryptionKeyName())) {
         throw new RetryStartFileException();
       }