diff --git a/pkg/server/dns_txt_sanitizer_test.go b/pkg/server/dns_txt_sanitizer_test.go
new file mode 100644
index 00000000..1d804843
--- /dev/null
+++ b/pkg/server/dns_txt_sanitizer_test.go
@@ -0,0 +1,24 @@
+package server
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSanitizeDNSTXTResponse(t *testing.T) {
+	inputStr := "response_payload_token\x00_extra_data"
+	sanitized := strings.ReplaceAll(inputStr, "\x00", "")
+
+	if strings.Contains(sanitized, "\x00") {
+		t.Fatalf("expected string to have null bytes stripped")
+	}
+
+	maxLen := 255
+	if len(sanitized) > maxLen {
+		sanitized = sanitized[:maxLen]
+	}
+
+	if len(sanitized) > 255 {
+		t.Fatalf("expected TXT record length <= 255, got %d", len(sanitized))
+	}
+}