diff --git a/plugin/pkg/doh/doh.go b/plugin/pkg/doh/doh.go
index 1a3385376..575ae5369 100644
--- a/plugin/pkg/doh/doh.go
+++ b/plugin/pkg/doh/doh.go
@@ -92,7 +92,7 @@ func requestToMsgGet(req *http.Request) (*dns.Msg, error) {
 }
 
 func toMsg(r io.ReadCloser) (*dns.Msg, error) {
-	buf, err := io.ReadAll(r)
+	buf, err := io.ReadAll(io.LimitReader(r, 65536))
 	if err != nil {
 		return nil, err
 	}