diff --git a/plugin/dns64/dns64.go b/plugin/dns64/dns64.go
index 01d98923b..f8efdfd9f 100644
--- a/plugin/dns64/dns64.go
+++ b/plugin/dns64/dns64.go
@@ -6,6 +6,7 @@ package dns64
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net"
 	"time"
 
@@ -122,6 +123,9 @@ func (d *DNS64) DoDNS64(ctx context.Context, w dns.ResponseWriter, r *dns.Msg, o
 	if err != nil {
 		return nil, err
 	}
+	if resp == nil {
+		return nil, fmt.Errorf("dns64: upstream returned no response")
+	}
 	out := d.Synthesize(r, origResponse, resp)
 	return out, nil
 }
diff --git a/plugin/dns64/dns64_test.go b/plugin/dns64/dns64_test.go
index a294721dc..c501fb2a2 100644
--- a/plugin/dns64/dns64_test.go
+++ b/plugin/dns64/dns64_test.go
@@ -554,3 +554,30 @@ func (fu *fakeUpstream) Lookup(_ context.Context, _ request.Request, name string
 
 	return fu.resp, nil
 }
+
+type nilUpstream struct{}
+
+func (n *nilUpstream) Lookup(_ context.Context, _ request.Request, _ string, _ uint16) (*dns.Msg, error) {
+	return nil, nil
+}
+func TestDNS64NilUpstreamResponse(t *testing.T) {
+	_, pfx, _ := net.ParseCIDR("64:ff9b::/96")
+
+	d := DNS64{
+		Prefix:   pfx,
+		Upstream: &nilUpstream{},
+	}
+
+	req := new(dns.Msg)
+	req.SetQuestion("example.com.", dns.TypeAAAA)
+
+	origResponse := new(dns.Msg)
+	origResponse.SetReply(req)
+
+	rec := dnstest.NewRecorder(&test.ResponseWriter{RemoteIP: "::1"})
+
+	_, err := d.DoDNS64(context.Background(), rec, req, origResponse)
+	if err == nil {
+		t.Error("Expected error when upstream returns nil response, got nil")
+	}
+}