diff --git a/common/fko_util.h b/common/fko_util.h
index af8d31fe..100d9982 100644
--- a/common/fko_util.h
+++ b/common/fko_util.h
@@ -35,7 +35,7 @@
 
 #define MAX_CMDLINE_ARGS   30    /*!< should be way more than enough */
 #define MAX_ARGS_LINE_LEN  1024
-#define MAX_HOSTNAME_LEN    64
+#define MAX_HOSTNAME_LEN    70
 
 /* Function prototypes
 */
diff --git a/lib/fko_message.c b/lib/fko_message.c
index de3d1b9e..1ce55680 100644
--- a/lib/fko_message.c
+++ b/lib/fko_message.c
@@ -304,17 +304,28 @@ int
 validate_nat_access_msg(const char *msg)
 {
     const char   *ndx;
+    int     host_len;
     int     res         = FKO_SUCCESS;
     int     startlen    = strnlen(msg, MAX_SPA_MESSAGE_SIZE);
 
     if(startlen == MAX_SPA_MESSAGE_SIZE)
         return(FKO_ERROR_INVALID_DATA_MESSAGE_NAT_MISSING);
 
-    /* Should always have a valid allow IP regardless of message type
-    *
-    if((res = have_allow_ip(msg)) != FKO_SUCCESS)
-        return(FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG);
+    /* must have exactly one comma here
     */
+    if(count_characters(msg, ',', startlen) != 1)
+        return(FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG);
+
+    /* Must not be longer than the max hostname length
+    */
+    host_len = strcspn(msg, ",");
+    if(host_len > MAX_HOSTNAME_LEN)
+        return(FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG);
+
+    /* Check for some invalid characters
+    */
+    if(strcspn(msg, " /?\"\'\\") < host_len)
+        return(FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG);
 
     /* Position ourselves beyond the allow IP and make sure we have
      * a single port value
diff --git a/server/fw_util_firewalld.c b/server/fw_util_firewalld.c
index 4047b5c2..3afd8ecb 100644
--- a/server/fw_util_firewalld.c
+++ b/server/fw_util_firewalld.c
@@ -1334,6 +1334,7 @@ process_spa_request(const fko_srv_options_t * const opts,
 
     char            *ndx = NULL;
     int             res = 0, is_err;
+    int             str_len;
     time_t          now;
     unsigned int    exp_ts;
 
@@ -1380,9 +1381,10 @@ process_spa_request(const fko_srv_options_t * const opts,
         else
         {
             ndx = strchr(spadat->nat_access, ',');
-            if(ndx != NULL)
+            str_len = strcspn(spadat->nat_access, ",");
+            if((ndx != NULL) && (str_len <= MAX_HOSTNAME_LEN))
             {
-                strlcpy(nat_dst, spadat->nat_access, (ndx-spadat->nat_access)+1);
+                strlcpy(nat_dst, spadat->nat_access, str_len+1);
                 if (! is_valid_ipv4_addr(nat_dst))
                 {
                     if (ipv4_resolve(nat_dst, nat_ip) == 0)
diff --git a/server/fw_util_iptables.c b/server/fw_util_iptables.c
index 74faf5e7..6ce25572 100644
--- a/server/fw_util_iptables.c
+++ b/server/fw_util_iptables.c
@@ -1321,6 +1321,7 @@ process_spa_request(const fko_srv_options_t * const opts,
 
     char            *ndx = NULL;
     int             res = 0, is_err;
+    int             str_len;
     time_t          now;
     unsigned int    exp_ts;
 
@@ -1367,9 +1368,10 @@ process_spa_request(const fko_srv_options_t * const opts,
         else
         {
             ndx = strchr(spadat->nat_access, ',');
-            if(ndx != NULL)
+            str_len = strcspn(spadat->nat_access, ",");
+            if((ndx != NULL) && (str_len <= MAX_HOSTNAME_LEN))
             {
-                strlcpy(nat_dst, spadat->nat_access, (ndx-spadat->nat_access)+1);
+                strlcpy(nat_dst, spadat->nat_access, str_len+1);
                 if (! is_valid_ipv4_addr(nat_dst))
                 {
                     if (ipv4_resolve(nat_dst, nat_ip) == 0)
diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h
index a8624be5..b60a154d 100644
--- a/server/fwknopd_common.h
+++ b/server/fwknopd_common.h
@@ -211,7 +211,6 @@
 #define MAX_PCAP_FILTER_LEN     1024
 #define MAX_IFNAME_LEN          128
 #define MAX_SPA_PACKET_LEN      1500 /* --DSS check this? */
-#define MAX_HOSTNAME_LEN        64
 #define MAX_DECRYPTED_SPA_LEN   1024
 
 /* The minimum possible valid SPA data size.