diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 54add8e..7cb1442 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -3238,6 +3238,15 @@
             if( ret == POLARSSL_ERR_SSL_INVALID_RECORD ||
                 ret == POLARSSL_ERR_SSL_INVALID_MAC )
             {
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+                if( ssl->badmac_limit != 0 &&
+                    ++ssl->badmac_seen >= ssl->badmac_limit )
+                {
+                    SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
+                    return( POLARSSL_ERR_SSL_INVALID_MAC );
+                }
+#endif
+
                 SSL_DEBUG_MSG( 1, ( "discarding invalid record" ) );
                 goto read_record_header;
             }
@@ -4923,6 +4932,13 @@
 }
 #endif
 
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+void ssl_set_dtls_badmac_limit( ssl_context *ssl, unsigned limit )
+{
+    ssl->badmac_limit = limit;
+}
+#endif
+
 #if defined(POLARSSL_SSL_PROTO_DTLS)
 void ssl_set_handshake_timeout( ssl_context *ssl, uint32_t min, uint32_t max )
 {