diff --git a/proxy/dns64.go b/proxy/dns64.go
index 2779ee117..4086869aa 100644
--- a/proxy/dns64.go
+++ b/proxy/dns64.go
@@ -51,6 +51,10 @@ func (p *Proxy) setupDNS64() (err error) {
 	}
 
 	for i, pref := range p.Config.DNS64Prefs {
+		if pref.Addr() == netip.MustParseAddr("::") {
+			return fmt.Errorf("prefix at index %d: %q has zero address", i, pref)
+		}
+
 		if !pref.Addr().Is6() {
 			return fmt.Errorf("prefix at index %d: %q is not an IPv6 prefix", i, pref)
 		}
diff --git a/proxy/dns64_internal_test.go b/proxy/dns64_internal_test.go
index 8fcc58611..8e78318d6 100644
--- a/proxy/dns64_internal_test.go
+++ b/proxy/dns64_internal_test.go
@@ -79,6 +79,21 @@ func TestDNS64Race(t *testing.T) {
 	g.Wait()
 }
 
+func TestSetupDNS64_ZeroAddressPrefix(t *testing.T) {
+	t.Parallel()
+
+	p := &Proxy{
+		Config: Config{
+			UseDNS64:   true,
+			DNS64Prefs: []netip.Prefix{netip.MustParsePrefix("::/96")},
+		},
+	}
+
+	err := p.setupDNS64()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "zero address")
+}
+
 func sendTestAAAAMessageAsync(conn *dns.Conn, g *sync.WaitGroup, fqdn string, syncCh chan struct{}) {
 	pt := testutil.PanicT{}