diff --git a/plugin/cache/cache.go b/plugin/cache/cache.go
index b2a2f6520..8cb49dceb 100644
--- a/plugin/cache/cache.go
+++ b/plugin/cache/cache.go
@@ -3,6 +3,7 @@ package cache
 
 import (
 	"encoding/binary"
+	"fmt"
 	"hash/fnv"
 	"net"
 	"strings"
@@ -413,6 +414,9 @@ func (w *ResponseWriter) Hijack() {
 
 // WriteMsg implements the dns.ResponseWriter interface.
 func (w *ResponseWriter) WriteMsg(res *dns.Msg) error {
+	if res == nil {
+		return fmt.Errorf("cache: response message is nil")
+	}
 	res = res.Copy()
 	w.lastItem = nil
 	mt := cacheResponseType(res, w.now().UTC())
diff --git a/plugin/cache/cache_test.go b/plugin/cache/cache_test.go
index 50f80bf5c..0fbaf390b 100644
--- a/plugin/cache/cache_test.go
+++ b/plugin/cache/cache_test.go
@@ -1990,3 +1990,21 @@ func TestServeFromStaleCacheFetchVerifyTimeoutMetadataIsolation(t *testing.T) {
 		t.Fatalf("background verifier mutated foreground metadata: %q", f())
 	}
 }
+
+func TestCacheWriteMsgNilResponse(t *testing.T) {
+	c := New()
+
+	rec := dnstest.NewRecorder(&test.ResponseWriter{})
+	cw := &ResponseWriter{ResponseWriter: rec, Cache: c}
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("ResponseWriter.WriteMsg panicked on nil response: %v", r)
+		}
+	}()
+
+	err := cw.WriteMsg(nil)
+	if err == nil {
+		t.Error("Expected error when passing nil response to WriteMsg, got nil")
+	}
+}