diff --git a/component/trie/domain_set.go b/component/trie/domain_set.go
index ce416e16..be793ad3 100644
--- a/component/trie/domain_set.go
+++ b/component/trie/domain_set.go
@@ -105,7 +105,7 @@ func (ss *DomainSet) Has(key string) bool {
 						}
 					}
 					for ; ; nextBmIdx++ {
-						if ss.labels[nextBmIdx-nextNodeId] == domainStepByte {
+						if nextBmIdx-nextNodeId < len(ss.labels) && ss.labels[nextBmIdx-nextNodeId] == domainStepByte {
 							bmIdx = nextBmIdx
 							nodeId = nextNodeId
 							i = j
diff --git a/component/trie/domain_set_test.go b/component/trie/domain_set_test.go
index c4160f6c..9e0e0b70 100644
--- a/component/trie/domain_set_test.go
+++ b/component/trie/domain_set_test.go
@@ -65,6 +65,7 @@ func TestDomainSetWildcard(t *testing.T) {
 		"stun.*.*",
 		"*.*.qq.com",
 		"test.*.baidu.com",
+		"*.apple.com",
 	}
 
 	for _, domain := range domainSet {
@@ -78,6 +79,7 @@ func TestDomainSetWildcard(t *testing.T) {
 	assert.True(t, set.Has("stun.ab.cd"))
 	assert.False(t, set.Has("test.baidu.com"))
 	assert.False(t, set.Has("www.google.com"))
+	assert.False(t, set.Has("a.www.google.com"))
 	assert.False(t, set.Has("test.qq.com"))
 	assert.False(t, set.Has("test.test.test.qq.com"))
 }