diff --git a/common.js b/common.js
index e166ae7..1925b6d 100644
--- a/common.js
+++ b/common.js
@@ -12,17 +12,24 @@ export default async function handler(
     headers.get("x-forwarded-for").split(",")[0].trim() ||
     headers.get("x-real-ip");
 
+  const bodyHex = Array.from(new Uint8Array(await request.arrayBuffer()))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+
   // Anti-GFW
   if (
+    isIPv4(ip) &&
     method === "POST" &&
     pathname === "/dns-query" &&
     headers.get("content-type") === "application/dns-message" &&
     headers.get("accept") === "application/dns-message" &&
     headers.get("content-length") === "29" &&
+    (headers.get("user-agent") === "Go-http-client/1.1" ||
+      headers.get("user-agent") === "Go-http-client/2.0") &&
     (headers.get("accept-encoding") === "gzip, br" ||
       headers.get("accept-encoding") === "gzip") &&
-    (headers.get("user-agent") === "Go-http-client/1.1" ||
-      headers.get("user-agent") === "Go-http-client/2.0")
+    bodyHex.slice(4) ===
+      "01100001000000000000077477697474657203636f6d0000010001"
   ) {
     return new Response(null, { status: 403 });
   }