diff --git a/dnsforward/dnsforward.go b/dnsforward/dnsforward.go
index b8a8afd1..64f5ff92 100644
--- a/dnsforward/dnsforward.go
+++ b/dnsforward/dnsforward.go
@@ -522,7 +522,7 @@ func (s *Server) filterDNSRequest(d *proxy.DNSContext) (*dnsfilter.Result, error
 
 	dnsFilter := s.dnsFilter
 
-	if !s.conf.ProtectionEnabled {
+	if !s.conf.ProtectionEnabled || s.dnsFilter == nil {
 		return &dnsfilter.Result{}, nil
 	}