diff --git a/Network/DNS/Decode.hs b/Network/DNS/Decode.hs
--- a/Network/DNS/Decode.hs
+++ b/Network/DNS/Decode.hs
@@ -196,8 +196,12 @@
 decodeRData TXT len = (RD_TXT . ignoreLength) <$> getNByteString len
   where
     ignoreLength = BS.tail
-decodeRData A len  = (RD_A . toIPv4) <$> getNBytes len
-decodeRData AAAA len  = (RD_AAAA . toIPv6b) <$> getNBytes len
+decodeRData A len
+  | len == 4  = (RD_A . toIPv4) <$> getNBytes len
+  | otherwise = fail "IPv4 addresses must be 4 bytes long"
+decodeRData AAAA len
+  | len == 16 = (RD_AAAA . toIPv6b) <$> getNBytes len
+  | otherwise = fail "IPv6 addresses must be 16 bytes long"
 decodeRData SOA _ = RD_SOA <$> decodeDomain
                            <*> decodeDomain
                            <*> decodeSerial
diff --git a/dns.cabal b/dns.cabal
--- a/dns.cabal
+++ b/dns.cabal
@@ -1,5 +1,5 @@
 Name:                   dns
-Version:                2.0.6
+Version:                2.0.7
 Author:                 Kazu Yamamoto <kazu@iij.ad.jp>
 Maintainer:             Kazu Yamamoto <kazu@iij.ad.jp>
 License:                BSD3