diff --git a/ntp-proto/src/packet/mac.rs b/ntp-proto/src/packet/mac.rs
index 468a88ac6..5d65ee936 100644
--- a/ntp-proto/src/packet/mac.rs
+++ b/ntp-proto/src/packet/mac.rs
@@ -32,7 +32,7 @@ impl<'a> Mac<'a> {
     pub(super) fn deserialize(
         data: &'a [u8],
     ) -> Result<Mac<'a>, ParsingError<std::convert::Infallible>> {
-        if data.len() < 4 || data.len() >= Self::MAXIMUM_SIZE {
+        if data.len() < 4 || data.len() > Self::MAXIMUM_SIZE {
             return Err(ParsingError::IncorrectLength);
         }
 
@@ -63,4 +63,24 @@ mod tests {
 
         assert_eq!(input, output);
     }
+
+    #[test]
+    fn accepts_various_lengths() {
+        for mac_len in [0usize, 16, 20] {
+            let mut data = Vec::with_capacity(4 + mac_len);
+            data.extend_from_slice(&42u32.to_be_bytes());
+            data.extend(std::iter::repeat(0xAA).take(mac_len));
+            let parsed = Mac::deserialize(&data).unwrap();
+            assert_eq!(parsed.keyid, 42);
+            assert_eq!(parsed.mac.len(), mac_len);
+        }
+    }
+
+    #[test]
+    fn rejects_too_long() {
+        let mut data = Vec::with_capacity(4 + Mac::MAXIMUM_SIZE + 1);
+        data.extend_from_slice(&1u32.to_be_bytes());
+        data.extend(std::iter::repeat(0xBB).take(Mac::MAXIMUM_SIZE + 1));
+        assert!(Mac::deserialize(&data).is_err());
+    }
 }