diff --git a/core/dnsserver/server.go b/core/dnsserver/server.go
index 52a2d6efc..eb23346e0 100644
--- a/core/dnsserver/server.go
+++ b/core/dnsserver/server.go
@@ -240,6 +240,10 @@ func (s *Server) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg)
 
 	for {
 		if h, ok := s.zones[q[off:]]; ok {
+			if h.pluginChain == nil { // zone defined, but has not got any plugins
+				errorAndMetricsFunc(s.Addr, w, r, dns.RcodeRefused)
+				return
+			}
 			if r.Question[0].Qtype != dns.TypeDS {
 				if h.FilterFunc == nil {
 					rcode, _ := h.pluginChain.ServeDNS(ctx, w, r)
diff --git a/test/chaos_test.go b/test/chaos_test.go
index 5178e5fc3..eb83a2759 100644
--- a/test/chaos_test.go
+++ b/test/chaos_test.go
@@ -32,6 +32,6 @@ func TestChaos(t *testing.T) {
 	chTxt := resp.Answer[0].(*dns.TXT).Txt[0]
 	version := caddy.AppName + "-" + caddy.AppVersion
 	if chTxt != version {
-		t.Fatalf("Expected version to bo %s, got %s", version, chTxt)
+		t.Fatalf("Expected version to be %s, got %s", version, chTxt)
 	}
 }
diff --git a/test/no_plugins_test.go b/test/no_plugins_test.go
new file mode 100644
index 000000000..51d546db3
--- /dev/null
+++ b/test/no_plugins_test.go
@@ -0,0 +1,28 @@
+package test
+
+import (
+	"testing"
+
+	"github.com/miekg/dns"
+)
+
+func TestNoPlugins(t *testing.T) {
+	corefile := `example.org:0 {
+	}`
+
+	i, udp, _, err := CoreDNSServerAndPorts(corefile)
+	if err != nil {
+		t.Fatalf("Could not get CoreDNS serving instance: %s", err)
+	}
+	defer i.Stop()
+
+	m := new(dns.Msg)
+	m.SetQuestion("example.org.", dns.TypeA)
+	resp, err := dns.Exchange(m, udp)
+	if err != nil {
+		t.Fatalf("Expected to receive reply, but didn't: %v", err)
+	}
+	if resp.Rcode != dns.RcodeRefused {
+		t.Fatalf("Expected rcode to be %d, got %d", dns.RcodeRefused, resp.Rcode)
+	}
+}