diff --git a/.twosky.json b/.twosky.json
index d2e029d28ff..aa30e882182 100644
--- a/.twosky.json
+++ b/.twosky.json
@@ -101,7 +101,7 @@
     "project_id": "hostlists-registry",
     "base_locale": "en",
     "localizable_files": [
-      "client/src/__locales-services/en.json"
+      "client/src/__locales-services/services.json"
     ],
     "languages": {
       "ar": "العربية",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23e85e46260..531b9c674f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -68,6 +68,8 @@ See also the [v0.107.78 GitHub milestone][ms-v0.107.78].
 
 - The parsing of the `ech` parameter in DNS rewrite rules for the HTTPS record type ([#8276]).
 
+- Validation of the `answer` field in DNS rewrite rules in case it is represented as CNAME.
+
 - Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.
 
 [#7955]:     https://github.com/AdguardTeam/AdGuardHome/issues/7955
diff --git a/client/src/__locales/ar.json b/client/src/__locales/ar.json
index 80690cf2382..2dde8fab74b 100644
--- a/client/src/__locales/ar.json
+++ b/client/src/__locales/ar.json
@@ -370,7 +370,7 @@
   "filters_enable": "تفعيل الفلاتر",
   "filters_interval": "الفاصل الزمني لتحديث الفلاتر",
   "fix": "يصلح",
-  "for_last_days": "لآخر {{value}} يوم",
+  "for_last_days": "لآخر {{count}} يوم",
   "for_last_days_plural": "لآخر {{count}} ايام",
   "for_last_hours": "لآخر {{count}} ساعة",
   "for_last_hours_plural": "لآخر {{count}} ساعة",
diff --git a/client/src/__locales/be.json b/client/src/__locales/be.json
index 3d1d5dd4c8f..e3be1a060c5 100644
--- a/client/src/__locales/be.json
+++ b/client/src/__locales/be.json
@@ -59,7 +59,7 @@
   "blocking_mode_custom_ip": "Карыстальніцкі IP: адказвае на ўручную наладжаны IP-адрас",
   "blocking_mode_default": "Стандартны: Адказвае з нулёвым IP-адрасам (0.0.0.0 для A; :: для AAAA), калі заблакавана правілам у стылі Adblock; адказвае з IP-адрасам, паказаным у правіле, калі заблакавана правілам у стылі /etc/hosts-style",
   "blocking_mode_null_ip": "Нулёвы IP: Адказвае з нулёвым IP-адрасам (0.0.0.0 для A; :: для AAAA)",
-  "blocking_mode_nxdomain": "NXDOMAIN: Адказвае з кодам NXDOMAIN\n",
+  "blocking_mode_nxdomain": "NXDOMAIN: Адказвае з кодам NXDOMAIN",
   "blocking_mode_refused": "REFUSED: Адказаць з кодам REFUSED",
   "blocklist": "Спіс заблакіраваных",
   "bootstrap_dns": "Bootstrap сервер DNS",
@@ -445,7 +445,7 @@
   "install_devices_ios_list_1": "Увайдзіце ў меню налад прылады.",
   "install_devices_ios_list_2": "Выберыце Wi-Fi у меню злева (немагчыма сканфігурыраваць DNS для мабільнай сеткі).",
   "install_devices_ios_list_3": "Націсніце на назву актыўнай у дадзены момант сеткі.",
-  "install_devices_ios_list_4": "У поле «DNS» увядзіце ўвядзіце адрасы AdGuard Home.",
+  "install_devices_ios_list_4": "У поле «DNS» увядзіце адрасы AdGuard Home.",
   "install_devices_macos_list_1": "Клікніце па абразку Apple і перайдзіце ў Сістэмныя налады.",
   "install_devices_macos_list_2": "Націсніце на значок «Сетка».",
   "install_devices_macos_list_3": "Выберыце першае падключэнне ў сваім спісе і націсніце кнопку «Дадаткова».",
diff --git a/client/src/__locales/de.json b/client/src/__locales/de.json
index c56bfc31b53..a78c735386c 100644
--- a/client/src/__locales/de.json
+++ b/client/src/__locales/de.json
@@ -386,7 +386,7 @@
   "form_enter_id": "Kennung eingeben",
   "form_enter_ip": "IP-Adresse eingeben",
   "form_enter_mac": "MAC-Adresse eingeben",
-  "form_enter_rate_limit": "Begrenzungswert eingeben",
+  "form_enter_rate_limit": "Ratenlimit eingeben",
   "form_enter_rate_limit_subnet_len": "Geben Sie die Subnetzpräfixlänge für die Ratebegrenzung ein",
   "form_enter_subnet_ip": "IP-Adresse zum Subnetz „{{cidr}}“ hinzufügen",
   "form_enter_upstream_timeout": "Geben Sie die Timeout-Dauer des Upstream-Servers in Sekunden ein",
@@ -570,16 +570,16 @@
   "query_log_retention_confirm": "Möchten Sie die Abfrageprotokollrotation wirklich ändern? Wenn Sie den Intervallwert verringern, gehen einige Daten verloren",
   "query_log_strict_search": "Doppelte Anführungszeichen für die strikte Suche verwenden",
   "query_log_updated": "Das Abfrageprotokoll wurde erfolgreich aktualisiert",
-  "rate_limit": "Begrenzungswert",
+  "rate_limit": "Ratenlimit",
   "rate_limit_desc": "Die Anzahl der Anfragen pro Sekunde, die ein einzelner Client stellen darf. Das Setzen auf 0 bedeutet keine Begrenzung.",
   "rate_limit_subnet_len_ipv4": "Länge des Subnetzpräfixes für IPv4-Adressen",
-  "rate_limit_subnet_len_ipv4_desc": "Subnetpräfixlänge für IPv4-Adressen, die für die Ratebegrenzung verwendet werden. Der Standardwert ist 24",
+  "rate_limit_subnet_len_ipv4_desc": "Subnetz-Präfixlänge für IPv4-Adressen, die für das Ratenlimit verwendet wird. Der Standardwert ist 24",
   "rate_limit_subnet_len_ipv4_error": "Die Subnetzpräfixlänge für IPv4-Adressen sollte zwischen 0 und 32 liegen",
   "rate_limit_subnet_len_ipv6": "Subnetzpräfixlänge für IPv6-Adressen",
-  "rate_limit_subnet_len_ipv6_desc": "Subnetpräfixlänge für IPv6-Adressen, die für die Ratebegrenzung verwendet werden. Der Standardwert ist 56",
+  "rate_limit_subnet_len_ipv6_desc": "Subnetz-Präfixlänge für IPv6-Adressen, die für das Ratenlimit verwendet wird. Der Standardwert ist 56",
   "rate_limit_subnet_len_ipv6_error": "Die Subnetzpräfixlänge für IPv6-Adressen sollte zwischen 0 und 128 liegen",
   "rate_limit_whitelist": "Zulassungsliste für die Ratebegrenzung",
-  "rate_limit_whitelist_desc": "IP-Adressen, die von der Ratebegrenzung ausgeschlossen sind",
+  "rate_limit_whitelist_desc": "IP-Adressen, die vom Ratenlimit ausgenommen sind",
   "rate_limit_whitelist_placeholder": "Geben Sie eine IP-Adresse - eine pro Zeile",
   "refresh_btn": "Aktualisieren",
   "refresh_statics": "Statistiken aktualisieren",
diff --git a/client/src/__locales/fa.json b/client/src/__locales/fa.json
index d5d88ab5e4f..58cb989b69e 100644
--- a/client/src/__locales/fa.json
+++ b/client/src/__locales/fa.json
@@ -481,7 +481,7 @@
   "install_welcome_title": "به AdGuard Home خوش آمدید!",
   "interval_24_hour": "24 ساعت",
   "interval_6_hour": "6 ساعت",
-  "interval_days": "{{value}} روز",
+  "interval_days": "{{count}} روز",
   "interval_days_plural": "{{count}} روز",
   "interval_hours": "{{count}} ساعت",
   "interval_hours_plural": "{{count}} ساعت",
diff --git a/client/src/__locales/id.json b/client/src/__locales/id.json
index c0088ee9701..a1d818ce58d 100644
--- a/client/src/__locales/id.json
+++ b/client/src/__locales/id.json
@@ -532,9 +532,9 @@
   "number_of_dns_query_blocked_24_hours": "Jumlah permintaan DNS yang diblokir oleh filter adblock dan daftar hitam host",
   "number_of_dns_query_blocked_24_hours_adult": "Jumlah situs web dewasa yang diblokir",
   "number_of_dns_query_blocked_24_hours_by_sec": "Jumlah permintaan DNS yang diblokir oleh modul keamanan penjelajahan AdGuard",
-  "number_of_dns_query_days": "Jumlah kueri DNS diproses selama {{value}} hari terakhir",
+  "number_of_dns_query_days": "Jumlah kueri DNS diproses selama {{count}} hari terakhir",
   "number_of_dns_query_days_plural": "Jumlah kueri DNS yang diproses selama {{count}} hari terakhir",
-  "number_of_dns_query_hours": "Jumlah kueri DNS diproses selama {{{count}} jam terakhir",
+  "number_of_dns_query_hours": "Jumlah kueri DNS diproses selama {{count}} jam terakhir",
   "number_of_dns_query_hours_plural": "Jumlah kueri DNS diproses selama {{count}} jam terakhir",
   "number_of_dns_query_to_safe_search": "Jumlah perminataan DNS ke mesin pencari yang dipaksa Pencarian Aman",
   "nxdomain": "NXDOMAIN",
diff --git a/client/src/__locales/ru.json b/client/src/__locales/ru.json
index ae648260470..5e58cbde133 100644
--- a/client/src/__locales/ru.json
+++ b/client/src/__locales/ru.json
@@ -445,7 +445,7 @@
   "install_devices_ios_list_1": "Войдите в меню настроек устройства.",
   "install_devices_ios_list_2": "Выберите пункт «Wi-Fi» (для мобильных сетей ручная настройка DNS невозможна).",
   "install_devices_ios_list_3": "Нажмите на название сети, к которой устройство подключено в данный момент.",
-  "install_devices_ios_list_4": "В поле «DNS» введите введите адреса AdGuard Home.",
+  "install_devices_ios_list_4": "В поле «DNS» введите адреса AdGuard Home.",
   "install_devices_macos_list_1": "Кликните на иконку Apple и перейдите в «Системные настройки».",
   "install_devices_macos_list_2": "Кликните на иконку «Сеть».",
   "install_devices_macos_list_3": "Выберите первое подключение в списке и нажмите кнопку «Дополнительно».",
diff --git a/client/src/__locales/si-lk.json b/client/src/__locales/si-lk.json
index dee9f9dc036..1b0501fec9d 100644
--- a/client/src/__locales/si-lk.json
+++ b/client/src/__locales/si-lk.json
@@ -397,7 +397,7 @@
   "form_error_ip_format": "අ.ජා.කෙ. (IP) ලිපිනය වලංගු නොවේ",
   "form_error_mac_format": "මා.ප්‍ර.පා. ලිපිනය වලංගු නොවේ",
   "form_error_password": "මුරපදය නොගැළපේ",
-  "form_error_password_length": "මුරපදය අකුරු {{min}} සහ {{value}} ක් අතර විය යුතුය",
+  "form_error_password_length": "මුරපදය අකුරු {{min}} සහ {{max}} ක් අතර විය යුතුය",
   "form_error_port": "වලංගු තොටක අගයක් යොදන්න",
   "form_error_port_range": "80-65535 පරාසය හි තොටක අගයක් ඇතුල් කරන්න",
   "form_error_port_unsafe": "මෙය අනාරක්‍ෂිත තොටකි",
diff --git a/client/src/__locales/tr.json b/client/src/__locales/tr.json
index a209d1294da..5106ec951f7 100644
--- a/client/src/__locales/tr.json
+++ b/client/src/__locales/tr.json
@@ -26,7 +26,7 @@
   "apply_btn": "Uygula",
   "auto_clients_desc": "AdGuard Home'u kullanan veya kullanabilecek cihazların IP adresleri hakkında bilgiler. Bu bilgiler, ana bilgisayar dosyaları, ters DNS sorguları ve çeşitli diğer kaynaklardan toplanmaktadır.",
   "auto_clients_title": "Bilinen istemciler",
-  "autofix_warning_list": "Şu görevleri gerçekleştirir: <0>Sistem DNSStubListener'ı devre dışı bırakır</0> <0>DNS sunucu adresini 127.0.0.1 olarak ayarlar</0> <0>/etc/resolv.conf'un sembolik bağlantı hedefini /run/systemd/resolve/resolv.conf ile değiştirir<0> <0>DNSStubListener'ı durdurur (systemd-resolved hizmeti yeniden yükler)</0>",
+  "autofix_warning_list": "Şu görevleri gerçekleştirir: <0>Sistem DNSStubListener'ı devre dışı bırakır</0> <0>DNS sunucu adresini 127.0.0.1 olarak ayarlar</0> <0>/etc/resolv.conf'un sembolik bağlantı hedefini /run/systemd/resolve/resolv.conf ile değiştirir</0> <0>DNSStubListener'ı durdurur (systemd-resolved hizmeti yeniden yükler)</0>",
   "autofix_warning_result": "Sonuç olarak, sisteminizden gelen tüm DNS istekleri varsayılan olarak AdGuard Home tarafından işlenecektir.",
   "autofix_warning_text": "\"Düzelt\" öğesine tıklarsanız, AdGuard Home, sisteminizi AdGuard Home DNS sunucusunu kullanacak şekilde yapılandıracaktır.",
   "average_processing_time": "Ortalama işlem süresi",
diff --git a/client/src/__locales/zh-hk.json b/client/src/__locales/zh-hk.json
index f88b8c71078..16abe5bdbd9 100644
--- a/client/src/__locales/zh-hk.json
+++ b/client/src/__locales/zh-hk.json
@@ -399,7 +399,7 @@
   "form_error_ip_format": "無效的 IP 格式",
   "form_error_mac_format": "無效的 「MAC 位址」格式",
   "form_error_password": "密碼不相符",
-  "form_error_password_length": "密碼必須至少 {{value}} 個字元長度",
+  "form_error_password_length": "密碼長度必須介於 {{min}} 至 {{max}} 個字元之間",
   "form_error_port": "輸入有效的連接埠",
   "form_error_port_range": "輸入範圍 80-65535 中的值",
   "form_error_port_unsafe": "這個連接埠不安全",
diff --git a/internal/filtering/rewritehttp.go b/internal/filtering/rewritehttp.go
index b619ca12020..cbac4ab4881 100644
--- a/internal/filtering/rewritehttp.go
+++ b/internal/filtering/rewritehttp.go
@@ -74,8 +74,6 @@ func (d *DNSFilter) handleRewriteAdd(w http.ResponseWriter, r *http.Request) {
 
 	err = rw.normalize(ctx, l)
 	if err != nil {
-		// Shouldn't happen currently, since normalize only returns a non-nil
-		// error when a rewrite is nil, but be change-proof.
 		aghhttp.ErrorAndLog(ctx, l, r, w, http.StatusBadRequest, "normalizing: %s", err)
 
 		return
@@ -173,8 +171,6 @@ func (d *DNSFilter) handleRewriteUpdate(w http.ResponseWriter, r *http.Request)
 
 	err = rwAdd.normalize(ctx, l)
 	if err != nil {
-		// Shouldn't happen currently, since normalize only returns a non-nil
-		// error when a rewrite is nil, but be change-proof.
 		aghhttp.ErrorAndLog(ctx, l, r, w, http.StatusBadRequest, "normalizing: %s", err)
 
 		return
diff --git a/internal/filtering/rewritehttp_test.go b/internal/filtering/rewritehttp_test.go
index f3734fd7a3c..5f2eb8f5854 100644
--- a/internal/filtering/rewritehttp_test.go
+++ b/internal/filtering/rewritehttp_test.go
@@ -50,6 +50,7 @@ const (
 	decodeUpdateErrorMsg = decodeMsg + " filtering.rewriteUpdateJSON\n"
 )
 
+// TODO(m.kazantsev):  Improve maintainability.
 func TestDNSFilter_HandleRewriteHTTP(t *testing.T) {
 	t.Parallel()
 
@@ -66,6 +67,7 @@ func TestDNSFilter_HandleRewriteHTTP(t *testing.T) {
 		updAnswer      = "upd.rewrite"
 		invDomain      = "inv.local"
 		invAnswer      = "inv.rewrite"
+		invalidDomain  = "invalid_domain"
 	)
 
 	testRewrites := []*rewriteJSON{
@@ -148,6 +150,21 @@ func TestDNSFilter_HandleRewriteHTTP(t *testing.T) {
 		wantStatus:  http.StatusBadRequest,
 		wantBody:    decodeErrorMsg,
 		wantList:    testRewrites,
+	}, {
+		name:   "add_error_invalid_cname",
+		url:    addURL,
+		method: http.MethodPost,
+		reqData: rewriteJSON{
+			Domain:  addDomain,
+			Answer:  invalidDomain,
+			Enabled: aghalg.NBTrue,
+		},
+		wantConfMod: false,
+		wantStatus:  http.StatusBadRequest,
+		wantBody: `normalizing: invalid CNAME target "` + invalidDomain + `": bad domain name ` +
+			`"` + invalidDomain + `": bad top-level domain name label "` + invalidDomain +
+			`": bad top-level domain name label rune '_'` + "\n",
+		wantList: testRewrites,
 	}, {
 		name:        "delete",
 		url:         deleteURL,
diff --git a/internal/filtering/rewrites.go b/internal/filtering/rewrites.go
index 6e9b247e032..71a2a5494f3 100644
--- a/internal/filtering/rewrites.go
+++ b/internal/filtering/rewrites.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/miekg/dns"
 )
 
@@ -93,6 +94,15 @@ func (rw *LegacyRewrite) normalize(ctx context.Context, l *slog.Logger) (err err
 	ip, err := netip.ParseAddr(rw.Answer)
 	if err != nil {
 		l.DebugContext(ctx, "normalizing legacy rewrite", slogutil.KeyError, err)
+
+		// Not an IP address, treat as CNAME target, but validate as a domain
+		// name first.
+		err = netutil.ValidateDomainName(rw.Answer)
+		if err != nil {
+			// Use capital letters, as the error message is shown to the user.
+			return fmt.Errorf("invalid CNAME target %q: %w", rw.Answer, err)
+		}
+
 		rw.Type = dns.TypeCNAME
 
 		return nil