diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd5293c1..1fc350b6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,11 +19,14 @@ and this project adheres to
 
 ### Fixed
 
+- Inconsistent responses for messages with EDNS0 and AD when DNS caching is
+  enabled ([#2600]).
 - Incomplete OpenWRT detection ([#2757]).
 - DHCP lease's `expired` field incorrect time format ([#2692]).
 - Incomplete DNS upstreams validation ([#2674]).
 - Wrong parsing of DHCP options of the `ip` type ([#2688]).
 
+[#2600]: https://github.com/AdguardTeam/AdGuardHome/issues/2600
 [#2674]: https://github.com/AdguardTeam/AdGuardHome/issues/2674
 [#2688]: https://github.com/AdguardTeam/AdGuardHome/issues/2688
 [#2692]: https://github.com/AdguardTeam/AdGuardHome/issues/2692
diff --git a/go.mod b/go.mod
index b8d18f43..e0224884 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.14
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.33.9
+	github.com/AdguardTeam/dnsproxy v0.35.3
 	github.com/AdguardTeam/golibs v0.4.4
 	github.com/AdguardTeam/urlfilter v0.14.3
 	github.com/NYTimes/gziphandler v1.1.1
diff --git a/go.sum b/go.sum
index 4afc5ca7..584609cf 100644
--- a/go.sum
+++ b/go.sum
@@ -18,8 +18,8 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr
 dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
-github.com/AdguardTeam/dnsproxy v0.33.9 h1:HUwywkhUV/M73E7qWcBAF+SdsNq742s82Lvox4pr/tM=
-github.com/AdguardTeam/dnsproxy v0.33.9/go.mod h1:dkI9VWh43XlOzF2XogDm1EmoVl7PANOR4isQV6X9LZs=
+github.com/AdguardTeam/dnsproxy v0.35.3 h1:mvXWoIZRRATJQyGTnq0O1ofbvuVMKRZMyycU/2tFiyE=
+github.com/AdguardTeam/dnsproxy v0.35.3/go.mod h1:dkI9VWh43XlOzF2XogDm1EmoVl7PANOR4isQV6X9LZs=
 github.com/AdguardTeam/golibs v0.4.0/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
 github.com/AdguardTeam/golibs v0.4.2 h1:7M28oTZFoFwNmp8eGPb3ImmYbxGaJLyQXeIFVHjME0o=
 github.com/AdguardTeam/golibs v0.4.2/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
diff --git a/internal/dnsforward/config.go b/internal/dnsforward/config.go
index 81864899..fdc8e5e2 100644
--- a/internal/dnsforward/config.go
+++ b/internal/dnsforward/config.go
@@ -276,14 +276,24 @@ func (s *Server) prepareUpstreamSettings() error {
 		upstreams = s.conf.UpstreamDNS
 	}
 	upstreams = filterOutComments(upstreams)
-	upstreamConfig, err := proxy.ParseUpstreamsConfig(upstreams, s.conf.BootstrapDNS, DefaultTimeout)
+	upstreamConfig, err := proxy.ParseUpstreamsConfig(upstreams,
+		upstream.Options{
+			Bootstrap: s.conf.BootstrapDNS,
+			Timeout:   DefaultTimeout,
+		},
+	)
 	if err != nil {
 		return fmt.Errorf("dns: proxy.ParseUpstreamsConfig: %w", err)
 	}
 
 	if len(upstreamConfig.Upstreams) == 0 {
 		log.Info("warning: no default upstream servers specified, using %v", defaultDNS)
-		uc, err := proxy.ParseUpstreamsConfig(defaultDNS, s.conf.BootstrapDNS, DefaultTimeout)
+		uc, err := proxy.ParseUpstreamsConfig(defaultDNS,
+			upstream.Options{
+				Bootstrap: s.conf.BootstrapDNS,
+				Timeout:   DefaultTimeout,
+			},
+		)
 		if err != nil {
 			return fmt.Errorf("dns: failed to parse default upstreams: %v", err)
 		}
diff --git a/internal/dnsforward/http.go b/internal/dnsforward/http.go
index 527d3b38..0a2269dc 100644
--- a/internal/dnsforward/http.go
+++ b/internal/dnsforward/http.go
@@ -150,7 +150,7 @@ func (req *dnsConfig) checkBootstrap() (string, error) {
 			return boot, fmt.Errorf("invalid bootstrap server address: empty")
 		}
 
-		if _, err := upstream.NewResolver(boot, 0); err != nil {
+		if _, err := upstream.NewResolver(boot, upstream.Options{Timeout: 0}); err != nil {
 			return boot, fmt.Errorf("invalid bootstrap server address: %w", err)
 		}
 	}
@@ -315,7 +315,12 @@ func ValidateUpstreams(upstreams []string) error {
 		return nil
 	}
 
-	_, err := proxy.ParseUpstreamsConfig(upstreams, []string{}, DefaultTimeout)
+	_, err := proxy.ParseUpstreamsConfig(upstreams,
+		upstream.Options{
+			Bootstrap: []string{},
+			Timeout:   DefaultTimeout,
+		},
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/home/clients.go b/internal/home/clients.go
index c3eb366f..5a9e9eac 100644
--- a/internal/home/clients.go
+++ b/internal/home/clients.go
@@ -17,6 +17,7 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/AdGuardHome/internal/util"
 	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/dnsproxy/upstream"
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/utils"
 )
@@ -295,7 +296,12 @@ func (clients *clientsContainer) FindUpstreams(ip string) *proxy.UpstreamConfig
 	}
 
 	if c.upstreamConfig == nil {
-		config, err := proxy.ParseUpstreamsConfig(c.Upstreams, config.DNS.BootstrapDNS, dnsforward.DefaultTimeout)
+		config, err := proxy.ParseUpstreamsConfig(c.Upstreams,
+			upstream.Options{
+				Bootstrap: config.DNS.BootstrapDNS,
+				Timeout:   dnsforward.DefaultTimeout,
+			},
+		)
 		if err == nil {
 			c.upstreamConfig = &config
 		}
diff --git a/internal/home/home_test.go b/internal/home/home_test.go
index 02613b7c..033b8e26 100644
--- a/internal/home/home_test.go
+++ b/internal/home/home_test.go
@@ -146,7 +146,7 @@ func TestHome(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
 	// test DNS over UDP
-	r, err := upstream.NewResolver("127.0.0.1:5354", 3*time.Second)
+	r, err := upstream.NewResolver("127.0.0.1:5354", upstream.Options{Timeout: 3 * time.Second})
 	assert.Nil(t, err)
 	addrs, err := r.LookupIPAddr(context.TODO(), "static.adguard.com")
 	assert.Nil(t, err)