diff --git a/app/src/main/jni/netguard/tcp.c b/app/src/main/jni/netguard/tcp.c
index b23aed12..d0122ad1 100644
--- a/app/src/main/jni/netguard/tcp.c
+++ b/app/src/main/jni/netguard/tcp.c
@@ -585,8 +585,10 @@ void check_tcp_socket(const struct arguments *args,
                         s->tcp.received += bytes;
 
                         // Process DNS response
-                        if (ntohs(s->tcp.dest) == 53)
-                            parse_dns_response(args, s, buffer, (size_t *) &bytes);
+                        if (ntohs(s->tcp.dest) == 53 && bytes > 2) {
+                            ssize_t dlen = bytes - 2;
+                            parse_dns_response(args, s, buffer + 2, (size_t *) &dlen);
+                        }
 
                         // Forward to tun
                         if (write_data(args, &s->tcp, buffer, (size_t) bytes) >= 0) {