diff --git a/CHANGELOG.md b/CHANGELOG.md
index 531b9c674..0377da170 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,12 @@ See also the [v0.107.79 GitHub milestone][ms-v0.107.79].
 NOTE: Add new changes BELOW THIS COMMENT.
 -->
 
+### Fixed
+
+- Blocked requests without an EDNS(0) OPT record ([#8183]).
+
+[#8183]:     https://github.com/AdguardTeam/AdGuardHome/issues/8183
+
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
 -->
@@ -62,8 +68,6 @@ See also the [v0.107.78 GitHub milestone][ms-v0.107.78].
 
 - The `filtering` object of the YAML configuration now includes a new property, `max_http_size`, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as `1 TB`.
 
-### Fixed
-
 - Invalid AA flag in DNS responses ([#7955]).
 
 - The parsing of the `ech` parameter in DNS rewrite rules for the HTTPS record type ([#8276]).
diff --git a/internal/dnsforward/msg.go b/internal/dnsforward/msg.go
index 5dba5927a..b361f22d7 100644
--- a/internal/dnsforward/msg.go
+++ b/internal/dnsforward/msg.go
@@ -17,10 +17,17 @@ import (
 // template.  Also extract all the methods to a separate entity.
 
 // reply creates a DNS response for req.
+//
+// NOTE: If req uses EDNS(0), the response copies its UDP size and DO flag.
 func (*Server) reply(req *dns.Msg, code int) (resp *dns.Msg) {
 	resp = (&dns.Msg{}).SetRcode(req, code)
 	resp.RecursionAvailable = true
 
+	opt := req.IsEdns0()
+	if opt != nil {
+		resp.SetEdns0(opt.UDPSize(), opt.Do())
+	}
+
 	return resp
 }
 
@@ -404,7 +411,11 @@ func (s *Server) NewMsgSERVFAIL(req *dns.Msg) (resp *dns.Msg) {
 // NewMsgNOTIMPLEMENTED implements the [proxy.MessageConstructor] interface for
 // *Server.
 func (s *Server) NewMsgNOTIMPLEMENTED(req *dns.Msg) (resp *dns.Msg) {
-	resp = s.reply(req, dns.RcodeNotImplemented)
+	// NOTE: [Server.reply] must not be used there, because it unconditionally
+	// copies UDP size and DO bit from the request, when in this case we want to
+	// use constant values.
+	resp = (&dns.Msg{}).SetRcode(req, dns.RcodeNotImplemented)
+	resp.RecursionAvailable = true
 
 	// Most of the Internet and especially the inner core has an MTU of at least
 	// 1500 octets.  Maximum DNS/UDP payload size for IPv6 on MTU 1500 ethernet
@@ -415,7 +426,10 @@ func (s *Server) NewMsgNOTIMPLEMENTED(req *dns.Msg) (resp *dns.Msg) {
 
 	// NOTIMPLEMENTED without EDNS is treated as 'we don't support EDNS', so
 	// explicitly set it.
-	resp.SetEdns0(maxUDPPayload, false)
+	opt := req.IsEdns0()
+	if opt != nil {
+		resp.SetEdns0(maxUDPPayload, false)
+	}
 
 	return resp
 }