diff --git a/.github/workflows/fuzz_target_dnsdistcache-mayhem.yml b/.github/workflows/fuzz_target_dnsdistcache-mayhem.yml
new file mode 100644
index 000000000000..04f9fd8cb1ce
--- /dev/null
+++ b/.github/workflows/fuzz_target_dnsdistcache-mayhem.yml
@@ -0,0 +1,55 @@
+name: Mayhem
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+jobs:
+  build:
+    name: ${{ matrix.os }} shared=${{ matrix.shared }} ${{ matrix.build_type }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        shared: [false]
+        build_type: [Release]
+        include:
+        - os: ubuntu-latest
+          triplet: x64-linux
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        submodules: recursive
+    - name: Log in to the Container registry
+      uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Extract metadata (tags, labels) for Docker
+      id: meta
+      uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+    - name: Build and push Docker image
+      uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+      with:
+        context: .
+        file: mayhem/Dockerfile
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+    - name: Start analysis
+      uses: forallsecure/mcode-action@v1
+      with:
+        mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
+        args: --image ${{ steps.meta.outputs.tags }} --cmd /out/fuzz_target_dnsdistcache
+          --target fuzz_target_dnsdistcache --file mayhem/fuzz_target_dnsdistcache.mayhemfile
+        sarif-output: sarif
+    - name: Upload SARIF file(s)
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: sarif
diff --git a/mayhem/Dockerfile b/mayhem/Dockerfile
new file mode 100644
index 000000000000..4b97cd4b4e3e
--- /dev/null
+++ b/mayhem/Dockerfile
@@ -0,0 +1,36 @@
+# Copyright 2018 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+# base image with clang toolchain
+FROM gcr.io/oss-fuzz-base/base-builder
+
+# maintainer for this file
+
+# install required packages to build your project
+RUN apt-get update && apt-get install -y autoconf automake bison dh-autoreconf flex boost1.71-all-dev libluajit-5.1-dev libedit-dev libprotobuf-dev libssl-dev libtool make pkg-config protobuf-compiler ragel
+
+# checkout all sources needed to build your project
+COPY . pdns
+RUN rm -rf pdns/mayhem
+
+# current directory for build script
+WORKDIR pdns
+
+# copy build script and other fuzzer files in src dir
+COPY mayhem/build.sh $SRC/
+
+ENV FUZZING_LANGUAGE=c++ SANITIZER=address
+RUN compile
\ No newline at end of file
diff --git a/mayhem/Dockerfile.dockerignore b/mayhem/Dockerfile.dockerignore
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/mayhem/build.sh b/mayhem/build.sh
new file mode 100644
index 000000000000..7da909ae2a92
--- /dev/null
+++ b/mayhem/build.sh
@@ -0,0 +1,64 @@
+#!/bin/bash -eu
+# Copyright 2018 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+# remove dependencies on boost's program_options, we don't need it
+# and it won't link because oss-fuzz adds -stdlib=libc++ to the flags,
+# which would require rebuilding boost
+sed -i 's/BOOST_PROGRAM_OPTIONS(\[mt\])//' configure.ac
+sed -i 's/AC_MSG_ERROR(\[Boost Program Options library not found\])/AC_MSG_NOTICE(\[Boost Program Options library not found\])/' configure.ac
+# we also need to disable building as PIE because libFuzzingEngine.a
+# does not appear to be compiled as PIC
+sed -i 's/AC_CC_PIE//' configure.ac
+
+# build fuzzing targets
+autoreconf -vi
+./configure \
+    --without-dynmodules \
+    --with-modules='' \
+    --disable-lua-records \
+    --disable-ixfrdist \
+    --enable-fuzz-targets \
+    --disable-dependency-tracking \
+    --disable-silent-rules || /bin/bash
+cd pdns
+make -j$(nproc) fuzz_targets
+
+# copy the fuzzing target binaries
+cp fuzz_target_* "${OUT}/"
+
+# copy the zones used in the regression tests to the "zones" corpus
+cp ../regression-tests/zones/* ../fuzzing/corpus/zones/
+
+# generate the corpus files
+if [ -d ../fuzzing/corpus/raw-dns-packets/ ]; then
+    zip -j "${OUT}/fuzz_target_dnsdistcache_seed_corpus.zip" ../fuzzing/corpus/raw-dns-packets/*
+fi
+if [ -d ../fuzzing/corpus/txt-records/ ]; then
+    zip -j "${OUT}/fuzz_target_dnslabeltext_parseRFC1035CharString_seed_corpus.zip" ../fuzzing/corpus/txt-records/*
+fi
+if [ -d ../fuzzing/corpus/raw-dns-packets/ ]; then
+    zip -j "${OUT}/fuzz_target_moadnsparser_seed_corpus.zip" ../fuzzing/corpus/raw-dns-packets/*
+fi
+if [ -d ../fuzzing/corpus/raw-dns-packets/ ]; then
+    zip -j "${OUT}/fuzz_target_packetcache_seed_corpus.zip" ../fuzzing/corpus/raw-dns-packets/*
+fi
+if [ -d ../fuzzing/corpus/proxy-protocol-raw-packets/ ]; then
+    zip -j "${OUT}/fuzz_target_proxyprotocol_seed_corpus.zip" ../fuzzing/corpus/proxy-protocol-raw-packets/*
+fi
+if [ -d ../fuzzing/corpus/zones/ ]; then
+    zip -j "${OUT}/fuzz_target_zoneparsertng_seed_corpus.zip" ../fuzzing/corpus/zones/*
+fi
diff --git a/mayhem/fuzz_target_dnsdistcache.mayhemfile b/mayhem/fuzz_target_dnsdistcache.mayhemfile
new file mode 100644
index 000000000000..c7e0a35f1b80
--- /dev/null
+++ b/mayhem/fuzz_target_dnsdistcache.mayhemfile
@@ -0,0 +1,4 @@
+project: PROJECT
+target: fuzz_target_dnsdistcache
+cmds:
+- cmd: /out/fuzz_target_dnsdistcache