diff --git a/go.mod b/go.mod
index d81cff9..940dca5 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/mjl-/mox
 go 1.21
 
 require (
-	github.com/mjl-/adns v0.0.0-20240309142737-2a1aacf346dc
+	github.com/mjl-/adns v0.0.0-20240509092456-2dc8715bf4af
 	github.com/mjl-/autocert v0.0.0-20231214125928-31b7400acb05
 	github.com/mjl-/bstore v0.0.5
 	github.com/mjl-/sconf v0.0.6
diff --git a/go.sum b/go.sum
index dfdf977..6bc1ee7 100644
--- a/go.sum
+++ b/go.sum
@@ -24,8 +24,8 @@ github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFB
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
 github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
-github.com/mjl-/adns v0.0.0-20240309142737-2a1aacf346dc h1:ghTx3KsrO0hSJW0bCFCGwjSrYeXZ6Bj5hdv9FTTFV4M=
-github.com/mjl-/adns v0.0.0-20240309142737-2a1aacf346dc/go.mod h1:v47qUMJnipnmDTRGaHwpCwzE6oypa5K33mUvBfzZBn8=
+github.com/mjl-/adns v0.0.0-20240509092456-2dc8715bf4af h1:sEDWZPIi5K1qKk7JQoAZyDwXkRQseIf7y5ony8JeYEQ=
+github.com/mjl-/adns v0.0.0-20240509092456-2dc8715bf4af/go.mod h1:v47qUMJnipnmDTRGaHwpCwzE6oypa5K33mUvBfzZBn8=
 github.com/mjl-/autocert v0.0.0-20231214125928-31b7400acb05 h1:s6ay4bh4tmpPLdxjyeWG45mcwHfEluBMuGPkqxHWUJ4=
 github.com/mjl-/autocert v0.0.0-20231214125928-31b7400acb05/go.mod h1:taMFU86abMxKLPV4Bynhv8enbYmS67b8LG80qZv2Qus=
 github.com/mjl-/bstore v0.0.5 h1:Cx+LWEBnFBsqSxZNMxeVujkfc0kG10lUJaAU4vWSRHo=
diff --git a/vendor/github.com/mjl-/adns/dnsclient_unix.go b/vendor/github.com/mjl-/adns/dnsclient_unix.go
index b436ad1..f744a7b 100644
--- a/vendor/github.com/mjl-/adns/dnsclient_unix.go
+++ b/vendor/github.com/mjl-/adns/dnsclient_unix.go
@@ -262,7 +262,9 @@ func checkHeader(p *dnsmessage.Parser, h dnsmessage.Header) error {
 					return errServerTemporarilyMisbehaving
 				}
 				if rh.Type != dnsmessage.TypeOPT {
-					p.SkipAdditional()
+					if err := p.SkipAdditional(); err != nil {
+						return errInvalidDNSResponse
+					}
 					continue
 				}
 				// Only one OPT record is allowed. With multiple we MUST return an error. See RFC
@@ -328,7 +330,9 @@ func extractExtendedRCode(p dnsmessage.Parser, hdr dnsmessage.Header) (dnsmessag
 		if ahdr.Type == dnsmessage.TypeOPT {
 			return ahdr.ExtendedRCode(hdr.RCode), hasAdd
 		}
-		p.SkipAdditional()
+		if err := p.SkipAdditional(); err != nil {
+			return hdr.RCode, hasAdd
+		}
 	}
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 66c3c4e..0a85c4d 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -7,7 +7,7 @@ github.com/cespare/xxhash/v2
 # github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0
 ## explicit; go 1.19
 github.com/matttproud/golang_protobuf_extensions/v2/pbutil
-# github.com/mjl-/adns v0.0.0-20240309142737-2a1aacf346dc
+# github.com/mjl-/adns v0.0.0-20240509092456-2dc8715bf4af
 ## explicit; go 1.20
 github.com/mjl-/adns
 github.com/mjl-/adns/internal/bytealg