diff --git a/dnsforward/dnsforward.go b/dnsforward/dnsforward.go
index 59b3e516..9c9121c5 100644
--- a/dnsforward/dnsforward.go
+++ b/dnsforward/dnsforward.go
@@ -686,12 +686,12 @@ func processFilteringAfterResponse(ctx *dnsContext) int {
 			d.Res.Answer = answer
 		}
 
-	case dnsfilter.RewriteEtcHosts:
 	case dnsfilter.NotFilteredWhiteList:
 		// nothing
 
 	default:
-		if !ctx.protectionEnabled {
+		if !ctx.protectionEnabled || // filters are disabled: there's nothing to check for
+			!ctx.responseFromUpstream { // only check response if it's from an upstream server
 			break
 		}
 		origResp2 := d.Res
@@ -817,6 +817,10 @@ func (s *Server) updateStats(d *proxy.DNSContext, elapsed time.Duration, res dns
 	case dnsfilter.NotFilteredWhiteList:
 		fallthrough
 	case dnsfilter.NotFilteredError:
+		fallthrough
+	case dnsfilter.ReasonRewrite:
+		fallthrough
+	case dnsfilter.RewriteEtcHosts:
 		e.Result = stats.RNotFiltered
 
 	case dnsfilter.FilteredSafeBrowsing:
diff --git a/util/auto_hosts.go b/util/auto_hosts.go
index a2ea56ae..0af5bf08 100644
--- a/util/auto_hosts.go
+++ b/util/auto_hosts.go
@@ -225,11 +225,15 @@ func (a *AutoHosts) update() {
 }
 
 // Process - get the list of IP addresses for the hostname
+// Return nil if not found
 func (a *AutoHosts) Process(host string) []net.IP {
+	var ipsCopy []net.IP
 	a.lock.Lock()
 	ips, _ := a.table[host]
-	ipsCopy := make([]net.IP, len(ips))
-	copy(ipsCopy, ips)
+	if len(ips) != 0 {
+		ipsCopy = make([]net.IP, len(ips))
+		copy(ipsCopy, ips)
+	}
 	a.lock.Unlock()
 	return ipsCopy
 }