diff --git a/internal/dnsforward/dnsforward_test.go b/internal/dnsforward/dnsforward_test.go
index 11275188..fb642045 100644
--- a/internal/dnsforward/dnsforward_test.go
+++ b/internal/dnsforward/dnsforward_test.go
@@ -500,7 +500,10 @@ func TestServerRace(t *testing.T) {
 }
 
 func TestSafeSearch(t *testing.T) {
-	var upsCalledCounter uint32
+	var (
+		upsCalledCounter uint32
+		wantCNAMECounter uint32
+	)
 
 	safeSearchConf := filtering.SafeSearchConfig{
 		Enabled: true,
@@ -615,6 +618,8 @@ func TestSafeSearch(t *testing.T) {
 
 				a := testutil.RequireTypeAssert[*dns.A](t, reply.Answer[1])
 				assert.NotEmpty(t, a.A)
+
+				atomic.AddUint32(&wantCNAMECounter, 1)
 			} else {
 				require.Len(t, reply.Answer, 1)
 
@@ -625,7 +630,10 @@ func TestSafeSearch(t *testing.T) {
 	}
 
 	t.Run("mock_upstream_is_used", func(t *testing.T) {
-		assert.Positive(t, atomic.LoadUint32(&upsCalledCounter))
+		called := atomic.LoadUint32(&upsCalledCounter)
+		want := atomic.LoadUint32(&wantCNAMECounter)
+
+		assert.Equal(t, want, called)
 	})
 }