diff --git a/plugin/proxyproto/setup.go b/plugin/proxyproto/setup.go
index fd4a3a7bb..58ce598e9 100644
--- a/plugin/proxyproto/setup.go
+++ b/plugin/proxyproto/setup.go
@@ -25,6 +25,7 @@ func setup(c *caddy.Controller) error {
 	var (
 		allowedIPNets              []*net.IPNet
 		policy                     = proxyproto.IGNORE
+		defaultSet                 bool
 		sessionTrackingTTL         time.Duration
 		sessionTrackingMaxSessions int
 	)
@@ -44,6 +45,7 @@ func setup(c *caddy.Controller) error {
 					allowedIPNets = append(allowedIPNets, ipnet)
 				}
 			case "default":
+				defaultSet = true
 				v := c.RemainingArgs()
 				if len(v) != 1 {
 					return plugin.Error("proxyproto", c.ArgErr())
@@ -84,6 +86,9 @@ func setup(c *caddy.Controller) error {
 	}
 	config.ProxyProtoConnPolicy = func(connPolicyOptions proxyproto.ConnPolicyOptions) (proxyproto.Policy, error) {
 		if len(allowedIPNets) == 0 {
+			if defaultSet {
+				return policy, nil
+			}
 			return proxyproto.USE, nil
 		}
 		h, _, _ := net.SplitHostPort(connPolicyOptions.Upstream.String())
diff --git a/plugin/proxyproto/setup_test.go b/plugin/proxyproto/setup_test.go
index 455748534..154c01055 100644
--- a/plugin/proxyproto/setup_test.go
+++ b/plugin/proxyproto/setup_test.go
@@ -1,12 +1,15 @@
 package proxyproto
 
 import (
+	"net"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/coredns/caddy"
 	"github.com/coredns/coredns/core/dnsserver"
+
+	proxyprotoLib "github.com/pires/go-proxyproto"
 )
 
 func TestSetup(t *testing.T) {
@@ -84,3 +87,32 @@ func TestSetup(t *testing.T) {
 		}
 	}
 }
+
+func TestDefaultPolicyWithoutAllow(t *testing.T) {
+	c := caddy.NewTestController(
+		"dns",
+		"proxyproto {\ndefault reject\n}",
+	)
+
+	if err := setup(c); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := dnsserver.GetConfig(c)
+
+	policy, err := cfg.ProxyProtoConnPolicy(
+		proxyprotoLib.ConnPolicyOptions{
+			Upstream: &net.TCPAddr{
+				IP:   net.ParseIP("192.0.2.1"),
+				Port: 53,
+			},
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if policy != proxyprotoLib.REJECT {
+		t.Fatalf("Expected REJECT, got %v", policy)
+	}
+}