diff --git a/cmd/cli/dns_proxy.go b/cmd/cli/dns_proxy.go
index 1185c6c..c5e5fd2 100644
--- a/cmd/cli/dns_proxy.go
+++ b/cmd/cli/dns_proxy.go
@@ -1049,6 +1049,7 @@ func (p *prog) performLeakingQuery(failedUpstreams map[string]*ctrld.UpstreamCon
 						p.um.mu.RUnlock()
 						continue
 					}
+					p.um.mu.RUnlock()
 					mainLog.Load().Debug().
 						Str("upstream", name).
 						Msg("checking upstream")