diff --git a/Cargo.lock b/Cargo.lock
index b6cadd5e69..562cacc8f0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2106,6 +2106,10 @@ dependencies = [
  "dns-service-client",
  "dropshot",
  "expectorate",
+ "hickory-client",
+ "hickory-proto",
+ "hickory-resolver",
+ "hickory-server",
  "http 0.2.12",
  "omicron-test-utils",
  "omicron-workspace-hack",
@@ -2125,10 +2129,6 @@ dependencies = [
  "thiserror",
  "tokio",
  "toml 0.8.19",
- "trust-dns-client",
- "trust-dns-proto",
- "trust-dns-resolver",
- "trust-dns-server",
  "uuid",
 ]
 
@@ -2408,6 +2408,7 @@ dependencies = [
  "clap",
  "colored",
  "dhcproto",
+ "hickory-resolver",
  "http 0.2.12",
  "humantime",
  "hyper 0.14.30",
@@ -2428,7 +2429,6 @@ dependencies = [
  "socket2 0.5.7",
  "tokio",
  "toml 0.8.19",
- "trust-dns-resolver",
  "uuid",
 ]
 
@@ -2450,6 +2450,18 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "enum-as-inner"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ffccbb6966c05b32ef8fbac435df276c4ae4d3dc55a8cd0eb9745e6c12f546a"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.74",
+]
+
 [[package]]
 name = "env_logger"
 version = "0.9.3"
@@ -3318,6 +3330,90 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46"
 
+[[package]]
+name = "hickory-client"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bab9683b08d8f8957a857b0236455d80e1886eaa8c6178af556aa7871fb61b55"
+dependencies = [
+ "cfg-if",
+ "data-encoding",
+ "futures-channel",
+ "futures-util",
+ "hickory-proto",
+ "once_cell",
+ "radix_trie",
+ "rand",
+ "thiserror",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "hickory-proto"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07698b8420e2f0d6447a436ba999ec85d8fbf2a398bbd737b82cac4a2e96e512"
+dependencies = [
+ "async-trait",
+ "cfg-if",
+ "data-encoding",
+ "enum-as-inner 0.6.0",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "idna 0.4.0",
+ "ipnet",
+ "once_cell",
+ "rand",
+ "thiserror",
+ "tinyvec",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-resolver"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28757f23aa75c98f254cf0405e6d8c25b831b32921b050a66692427679b1f243"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-proto",
+ "ipconfig",
+ "lru-cache",
+ "once_cell",
+ "parking_lot 0.12.2",
+ "rand",
+ "resolv-conf",
+ "smallvec 1.13.2",
+ "thiserror",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "hickory-server"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9be0e43c556b9b3fdb6c7c71a9a32153a2275d02419e3de809e520bfcfe40c37"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "cfg-if",
+ "enum-as-inner 0.6.0",
+ "futures-util",
+ "hickory-proto",
+ "serde",
+ "thiserror",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "highway"
 version = "1.2.0"
@@ -3681,6 +3777,16 @@ dependencies = [
  "unicode-normalization",
 ]
 
+[[package]]
+name = "idna"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "idna"
 version = "0.5.0"
@@ -3947,6 +4053,7 @@ dependencies = [
  "dropshot",
  "expectorate",
  "futures",
+ "hickory-resolver",
  "hyper 0.14.30",
  "omicron-common",
  "omicron-test-utils",
@@ -3961,7 +4068,6 @@ dependencies = [
  "tempfile",
  "thiserror",
  "tokio",
- "trust-dns-resolver",
  "uuid",
 ]
 
@@ -3972,12 +4078,12 @@ dependencies = [
  "anyhow",
  "clap",
  "dropshot",
+ "hickory-resolver",
  "internal-dns",
  "omicron-common",
  "omicron-workspace-hack",
  "slog",
  "tokio",
- "trust-dns-resolver",
 ]
 
 [[package]]
@@ -5292,6 +5398,7 @@ dependencies = [
  "gateway-messages",
  "gateway-test-utils",
  "headers",
+ "hickory-resolver",
  "http 0.2.12",
  "hyper 0.14.30",
  "illumos-utils",
@@ -5318,7 +5425,6 @@ dependencies = [
  "slog",
  "tokio",
  "tokio-util",
- "trust-dns-resolver",
  "uuid",
 ]
 
@@ -5920,6 +6026,7 @@ dependencies = [
  "gateway-test-utils",
  "headers",
  "hex",
+ "hickory-resolver",
  "http 0.2.12",
  "httptest",
  "hubtools",
@@ -6012,7 +6119,6 @@ dependencies = [
  "tokio-postgres",
  "tokio-util",
  "tough",
- "trust-dns-resolver",
  "tufaceous",
  "tufaceous-lib",
  "update-common",
@@ -6368,6 +6474,7 @@ dependencies = [
  "group",
  "hashbrown 0.14.5",
  "hex",
+ "hickory-proto",
  "hmac",
  "hyper 0.14.30",
  "indexmap 2.4.0",
@@ -6431,7 +6538,6 @@ dependencies = [
  "toml_edit 0.19.15",
  "toml_edit 0.22.20",
  "tracing",
- "trust-dns-proto",
  "unicode-bidi",
  "unicode-normalization",
  "unicode-xid",
@@ -6677,6 +6783,7 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "futures",
+ "hickory-resolver",
  "http 0.2.12",
  "hyper 0.14.30",
  "omicron-workspace-hack",
@@ -6688,7 +6795,6 @@ dependencies = [
  "serde_json",
  "thiserror",
  "tokio",
- "trust-dns-resolver",
  "uuid",
 ]
 
@@ -10573,15 +10679,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "toml"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "toml"
 version = "0.7.8"
@@ -10754,26 +10851,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "trust-dns-client"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c408c32e6a9dbb38037cece35740f2cf23c875d8ca134d33631cec83f74d3fe"
-dependencies = [
- "cfg-if",
- "data-encoding",
- "futures-channel",
- "futures-util",
- "lazy_static",
- "radix_trie",
- "rand",
- "thiserror",
- "time",
- "tokio",
- "tracing",
- "trust-dns-proto",
-]
-
 [[package]]
 name = "trust-dns-proto"
 version = "0.22.0"
@@ -10783,7 +10860,7 @@ dependencies = [
  "async-trait",
  "cfg-if",
  "data-encoding",
- "enum-as-inner",
+ "enum-as-inner 0.5.1",
  "futures-channel",
  "futures-io",
  "futures-util",
@@ -10794,53 +10871,10 @@ dependencies = [
  "smallvec 1.13.2",
  "thiserror",
  "tinyvec",
- "tokio",
  "tracing",
  "url",
 ]
 
-[[package]]
-name = "trust-dns-resolver"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aff21aa4dcefb0a1afbfac26deb0adc93888c7d295fb63ab273ef276ba2b7cfe"
-dependencies = [
- "cfg-if",
- "futures-util",
- "ipconfig",
- "lazy_static",
- "lru-cache",
- "parking_lot 0.12.2",
- "resolv-conf",
- "smallvec 1.13.2",
- "thiserror",
- "tokio",
- "tracing",
- "trust-dns-proto",
-]
-
-[[package]]
-name = "trust-dns-server"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99022f9befa6daec2a860be68ac28b1f0d9d7ccf441d8c5a695e35a58d88840d"
-dependencies = [
- "async-trait",
- "bytes",
- "cfg-if",
- "enum-as-inner",
- "futures-executor",
- "futures-util",
- "serde",
- "thiserror",
- "time",
- "tokio",
- "toml 0.5.11",
- "tracing",
- "trust-dns-client",
- "trust-dns-proto",
-]
-
 [[package]]
 name = "try-lock"
 version = "0.2.5"
@@ -11707,6 +11741,7 @@ dependencies = [
  "gateway-messages",
  "gateway-test-utils",
  "hex",
+ "hickory-resolver",
  "http 0.2.12",
  "hubtools",
  "hyper 0.14.30",
@@ -11746,7 +11781,6 @@ dependencies = [
  "tokio-util",
  "toml 0.8.19",
  "tough",
- "trust-dns-resolver",
  "tufaceous",
  "tufaceous-lib",
  "update-common",
diff --git a/Cargo.toml b/Cargo.toml
index a1ae9858ab..4169c91b69 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -362,6 +362,10 @@ headers = "0.3.9"
 heck = "0.5"
 hex = "0.4.3"
 hex-literal = "0.4.1"
+hickory-client = "0.24.1"
+hickory-proto = "0.24.1"
+hickory-resolver = "0.24.1"
+hickory-server = "0.24.1"
 highway = "1.2.0"
 hkdf = "0.12.4"
 http = "0.2.12"
@@ -572,10 +576,6 @@ tokio-util = { version = "0.7.11", features = ["io", "io-util"] }
 toml = "0.8.19"
 toml_edit = "0.22.20"
 tough = { version = "0.17.1", features = [ "http" ] }
-trust-dns-client = "0.22"
-trust-dns-proto = "0.22"
-trust-dns-resolver = "0.22"
-trust-dns-server = "0.22"
 trybuild = "1.0.99"
 tufaceous = { path = "tufaceous" }
 tufaceous-lib = { path = "tufaceous-lib" }
diff --git a/clients/oxide-client/Cargo.toml b/clients/oxide-client/Cargo.toml
index f2adcacb1b..183640946f 100644
--- a/clients/oxide-client/Cargo.toml
+++ b/clients/oxide-client/Cargo.toml
@@ -12,6 +12,7 @@ anyhow.workspace = true
 base64.workspace = true
 chrono.workspace = true
 futures.workspace = true
+hickory-resolver.workspace = true
 http.workspace = true
 hyper.workspace = true
 progenitor.workspace = true
@@ -22,6 +23,5 @@ serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = [ "net" ] }
-trust-dns-resolver.workspace = true
 uuid.workspace = true
 omicron-workspace-hack.workspace = true
diff --git a/clients/oxide-client/src/lib.rs b/clients/oxide-client/src/lib.rs
index 07a190c38e..249ea18146 100644
--- a/clients/oxide-client/src/lib.rs
+++ b/clients/oxide-client/src/lib.rs
@@ -7,13 +7,13 @@
 use anyhow::anyhow;
 use anyhow::Context;
 use futures::FutureExt;
+use hickory_resolver::config::{
+    NameServerConfig, Protocol, ResolverConfig, ResolverOpts,
+};
+use hickory_resolver::TokioAsyncResolver;
 use std::net::SocketAddr;
 use std::sync::Arc;
 use thiserror::Error;
-use trust_dns_resolver::config::{
-    NameServerConfig, Protocol, ResolverConfig, ResolverOpts,
-};
-use trust_dns_resolver::TokioAsyncResolver;
 
 progenitor::generate_api!(
     spec = "../../openapi/nexus.json",
@@ -46,14 +46,15 @@ impl CustomDnsResolver {
             socket_addr: dns_addr,
             protocol: Protocol::Udp,
             tls_dns_name: None,
-            trust_nx_responses: false,
+            trust_negative_responses: false,
             bind_addr: None,
         });
+        let mut resolver_opts = ResolverOpts::default();
+        // Enable edns for potentially larger records
+        resolver_opts.edns0 = true;
 
-        let resolver = Arc::new(
-            TokioAsyncResolver::tokio(resolver_config, ResolverOpts::default())
-                .context("failed to create resolver")?,
-        );
+        let resolver =
+            Arc::new(TokioAsyncResolver::tokio(resolver_config, resolver_opts));
         Ok(CustomDnsResolver { dns_addr, resolver })
     }
 
diff --git a/dns-server/Cargo.toml b/dns-server/Cargo.toml
index d11dabaf85..b4516b8b77 100644
--- a/dns-server/Cargo.toml
+++ b/dns-server/Cargo.toml
@@ -15,24 +15,24 @@ clap.workspace = true
 dns-server-api.workspace = true
 dns-service-client.workspace = true
 dropshot.workspace = true
+hickory-client.workspace = true
+hickory-proto.workspace = true
+hickory-resolver.workspace = true
+hickory-server.workspace = true
 http.workspace = true
 pretty-hex.workspace = true
 schemars.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 sled.workspace = true
-slog.workspace = true
-slog-term.workspace = true
 slog-async.workspace = true
 slog-envlogger.workspace = true
+slog-term.workspace = true
+slog.workspace = true
 tempfile.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = [ "full" ] }
 toml.workspace = true
-trust-dns-client.workspace = true
-trust-dns-proto.workspace = true
-trust-dns-resolver.workspace = true
-trust-dns-server.workspace = true
 uuid.workspace = true
 omicron-workspace-hack.workspace = true
 
@@ -44,4 +44,3 @@ openapiv3.workspace = true
 openapi-lint.workspace = true
 serde_json.workspace = true
 subprocess.workspace = true
-trust-dns-resolver.workspace = true
diff --git a/dns-server/src/bin/dns-server.rs b/dns-server/src/bin/dns-server.rs
index 52a9c17c0d..9e8d098ee2 100644
--- a/dns-server/src/bin/dns-server.rs
+++ b/dns-server/src/bin/dns-server.rs
@@ -3,7 +3,7 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 //! Executable that starts the HTTP-configurable DNS server used for both
-//! internal DNS (RFD 248) and extenral DNS (RFD 357) for the Oxide system
+//! internal DNS (RFD 248) and external DNS (RFD 357) for the Oxide system
 
 use anyhow::anyhow;
 use anyhow::Context;
diff --git a/dns-server/src/dns_server.rs b/dns-server/src/dns_server.rs
index 5c761f2aa3..4ecbe382c8 100644
--- a/dns-server/src/dns_server.rs
+++ b/dns-server/src/dns_server.rs
@@ -13,6 +13,19 @@ use crate::storage::Store;
 use anyhow::anyhow;
 use anyhow::Context;
 use dns_server_api::DnsRecord;
+use hickory_proto::op::Header;
+use hickory_proto::op::ResponseCode;
+use hickory_proto::rr::rdata::SRV;
+use hickory_proto::rr::RData;
+use hickory_proto::rr::Record;
+use hickory_proto::rr::RecordType;
+use hickory_proto::serialize::binary::BinDecodable;
+use hickory_proto::serialize::binary::BinDecoder;
+use hickory_proto::serialize::binary::BinEncoder;
+use hickory_resolver::Name;
+use hickory_server::authority::MessageRequest;
+use hickory_server::authority::MessageResponse;
+use hickory_server::authority::MessageResponseBuilder;
 use pretty_hex::*;
 use serde::Deserialize;
 use slog::{debug, error, info, o, trace, Logger};
@@ -21,17 +34,6 @@ use std::str::FromStr;
 use std::sync::Arc;
 use thiserror::Error;
 use tokio::net::UdpSocket;
-use trust_dns_proto::op::header::Header;
-use trust_dns_proto::op::response_code::ResponseCode;
-use trust_dns_proto::rr::rdata::SRV;
-use trust_dns_proto::rr::record_data::RData;
-use trust_dns_proto::rr::record_type::RecordType;
-use trust_dns_proto::rr::{Name, Record};
-use trust_dns_proto::serialize::binary::{
-    BinDecodable, BinDecoder, BinEncoder,
-};
-use trust_dns_server::authority::MessageResponse;
-use trust_dns_server::authority::{MessageRequest, MessageResponseBuilder};
 use uuid::Uuid;
 
 /// Configuration related to the DNS server
@@ -167,7 +169,10 @@ async fn handle_dns_packet(request: Request) {
         Err(error) => {
             let header = Header::response_from_request(mr.header());
             let rb_servfail = MessageResponseBuilder::from_message_request(&mr);
-            error!(log, "failed to handle incoming DNS message: {:#}", error);
+            error!(
+                log,
+                "failed to handle incoming DNS message: {:#?} {:#}", mr, error
+            );
             match error {
                 RequestError::NxDomain(_) => {
                     let rb_nxdomain =
@@ -222,7 +227,7 @@ fn dns_record_to_record(
             let mut a = Record::new();
             a.set_name(name.clone())
                 .set_rr_type(RecordType::A)
-                .set_data(Some(RData::A(addr)));
+                .set_data(Some(RData::A(addr.into())));
             Ok(a)
         }
 
@@ -230,7 +235,7 @@ fn dns_record_to_record(
             let mut aaaa = Record::new();
             aaaa.set_name(name.clone())
                 .set_rr_type(RecordType::AAAA)
-                .set_data(Some(RData::AAAA(addr)));
+                .set_data(Some(RData::AAAA(addr.into())));
             Ok(aaaa)
         }
 
diff --git a/dns-server/src/lib.rs b/dns-server/src/lib.rs
index 424159e41d..8abd3b945e 100644
--- a/dns-server/src/lib.rs
+++ b/dns-server/src/lib.rs
@@ -47,13 +47,13 @@ pub mod http_server;
 pub mod storage;
 
 use anyhow::{anyhow, Context};
+use hickory_resolver::config::NameServerConfig;
+use hickory_resolver::config::Protocol;
+use hickory_resolver::config::ResolverConfig;
+use hickory_resolver::config::ResolverOpts;
+use hickory_resolver::TokioAsyncResolver;
 use slog::o;
 use std::net::SocketAddr;
-use trust_dns_resolver::config::NameServerConfig;
-use trust_dns_resolver::config::Protocol;
-use trust_dns_resolver::config::ResolverConfig;
-use trust_dns_resolver::config::ResolverOpts;
-use trust_dns_resolver::TokioAsyncResolver;
 
 /// Starts both the HTTP and DNS servers over a given store.
 pub async fn start_servers(
@@ -167,12 +167,14 @@ impl TransientServer {
             socket_addr: self.dns_server.local_address(),
             protocol: Protocol::Udp,
             tls_dns_name: None,
-            trust_nx_responses: false,
+            trust_negative_responses: false,
             bind_addr: None,
         });
+        let mut resolver_opts = ResolverOpts::default();
+        // Enable edns for potentially larger records
+        resolver_opts.edns0 = true;
         let resolver =
-            TokioAsyncResolver::tokio(resolver_config, ResolverOpts::default())
-                .context("creating DNS resolver")?;
+            TokioAsyncResolver::tokio(resolver_config, resolver_opts);
         Ok(resolver)
     }
 }
diff --git a/dns-server/src/storage.rs b/dns-server/src/storage.rs
index 85b2e79b8b..b3141f6751 100644
--- a/dns-server/src/storage.rs
+++ b/dns-server/src/storage.rs
@@ -95,6 +95,8 @@
 use anyhow::{anyhow, Context};
 use camino::Utf8PathBuf;
 use dns_server_api::{DnsConfig, DnsConfigParams, DnsConfigZone, DnsRecord};
+use hickory_proto::rr::LowerName;
+use hickory_resolver::Name;
 use serde::{Deserialize, Serialize};
 use sled::transaction::ConflictableTransactionError;
 use slog::{debug, error, info, o, warn};
@@ -104,8 +106,6 @@ use std::sync::atomic::Ordering;
 use std::sync::Arc;
 use thiserror::Error;
 use tokio::sync::Mutex;
-use trust_dns_client::rr::LowerName;
-use trust_dns_client::rr::Name;
 
 const KEY_CONFIG: &'static str = "config";
 
@@ -586,7 +586,7 @@ impl Store {
     /// If the returned set would have been empty, returns `QueryError::NoName`.
     pub(crate) fn query(
         &self,
-        mr: &trust_dns_server::authority::MessageRequest,
+        mr: &hickory_server::authority::MessageRequest,
     ) -> Result<Vec<DnsRecord>, QueryError> {
         let name = mr.query().name();
         let orig_name = mr.query().original().name();
@@ -784,14 +784,14 @@ mod test {
     use dns_server_api::DnsConfigParams;
     use dns_server_api::DnsConfigZone;
     use dns_server_api::DnsRecord;
+    use hickory_proto::rr::LowerName;
+    use hickory_resolver::Name;
     use omicron_test_utils::dev::test_setup_log;
     use std::collections::BTreeSet;
     use std::collections::HashMap;
     use std::net::Ipv6Addr;
     use std::str::FromStr;
     use std::sync::Arc;
-    use trust_dns_client::rr::LowerName;
-    use trust_dns_client::rr::Name;
 
     /// As usual, `TestContext` groups the various pieces we need in a bunch of
     /// our tests and helps make sure they get cleaned up properly.
diff --git a/dns-server/tests/basic_test.rs b/dns-server/tests/basic_test.rs
index b3b7f37378..fa5bfea468 100644
--- a/dns-server/tests/basic_test.rs
+++ b/dns-server/tests/basic_test.rs
@@ -9,6 +9,12 @@ use dns_service_client::{
     Client,
 };
 use dropshot::{test_util::LogContext, HandlerTaskMode};
+use hickory_resolver::error::ResolveErrorKind;
+use hickory_resolver::TokioAsyncResolver;
+use hickory_resolver::{
+    config::{NameServerConfig, Protocol, ResolverConfig, ResolverOpts},
+    proto::op::ResponseCode,
+};
 use omicron_test_utils::dev::test_setup_log;
 use slog::o;
 use std::{
@@ -16,12 +22,6 @@ use std::{
     net::Ipv6Addr,
     net::{IpAddr, Ipv4Addr},
 };
-use trust_dns_resolver::error::ResolveErrorKind;
-use trust_dns_resolver::TokioAsyncResolver;
-use trust_dns_resolver::{
-    config::{NameServerConfig, Protocol, ResolverConfig, ResolverOpts},
-    proto::op::ResponseCode,
-};
 
 const TEST_ZONE: &'static str = "oxide.internal";
 
@@ -374,17 +374,19 @@ async fn init_client_server(
     )
     .await?;
 
-    let mut rc = ResolverConfig::new();
-    rc.add_name_server(NameServerConfig {
+    let mut resolver_config = ResolverConfig::new();
+    resolver_config.add_name_server(NameServerConfig {
         socket_addr: dns_server.local_address(),
         protocol: Protocol::Udp,
         tls_dns_name: None,
-        trust_nx_responses: false,
+        trust_negative_responses: false,
         bind_addr: None,
     });
+    let mut resolver_opts = ResolverOpts::default();
+    // Enable edns for potentially larger records
+    resolver_opts.edns0 = true;
 
-    let resolver =
-        TokioAsyncResolver::tokio(rc, ResolverOpts::default()).unwrap();
+    let resolver = TokioAsyncResolver::tokio(resolver_config, resolver_opts);
     let client =
         Client::new(&format!("http://{}", dropshot_server.local_addr()), log);
 
diff --git a/end-to-end-tests/Cargo.toml b/end-to-end-tests/Cargo.toml
index 781f3fb1c6..b2400f7603 100644
--- a/end-to-end-tests/Cargo.toml
+++ b/end-to-end-tests/Cargo.toml
@@ -26,7 +26,7 @@ serde_json.workspace = true
 sled-agent-types.workspace = true
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
 toml.workspace = true
-trust-dns-resolver.workspace = true
+hickory-resolver.workspace = true
 uuid.workspace = true
 omicron-workspace-hack.workspace = true
 ispf.workspace = true
diff --git a/end-to-end-tests/src/helpers/ctx.rs b/end-to-end-tests/src/helpers/ctx.rs
index d9a2d7027a..5363557502 100644
--- a/end-to-end-tests/src/helpers/ctx.rs
+++ b/end-to-end-tests/src/helpers/ctx.rs
@@ -1,6 +1,7 @@
 use crate::helpers::generate_name;
 use anyhow::{anyhow, Context as _, Result};
 use chrono::Utc;
+use hickory_resolver::error::ResolveErrorKind;
 use omicron_test_utils::dev::poll::{wait_for_condition, CondCheckError};
 use oxide_client::types::{Name, ProjectCreate};
 use oxide_client::CustomDnsResolver;
@@ -13,7 +14,6 @@ use std::net::IpAddr;
 use std::net::SocketAddr;
 use std::sync::Arc;
 use std::time::Duration;
-use trust_dns_resolver::error::ResolveErrorKind;
 use uuid::Uuid;
 
 const RSS_CONFIG_STR: &str = include_str!(concat!(
diff --git a/internal-dns-cli/Cargo.toml b/internal-dns-cli/Cargo.toml
index dae0af0280..3e34c21622 100644
--- a/internal-dns-cli/Cargo.toml
+++ b/internal-dns-cli/Cargo.toml
@@ -11,9 +11,9 @@ workspace = true
 anyhow.workspace = true
 clap.workspace = true
 dropshot.workspace = true
+hickory-resolver.workspace = true
 internal-dns.workspace = true
 omicron-common.workspace = true
 slog.workspace = true
 tokio.workspace = true
-trust-dns-resolver.workspace = true
 omicron-workspace-hack.workspace = true
diff --git a/internal-dns-cli/src/bin/dnswait.rs b/internal-dns-cli/src/bin/dnswait.rs
index 9e003ed14f..8dbd675d64 100644
--- a/internal-dns-cli/src/bin/dnswait.rs
+++ b/internal-dns-cli/src/bin/dnswait.rs
@@ -65,10 +65,8 @@ async fn main() -> Result<()> {
 
     let resolver = if opt.nameserver_addresses.is_empty() {
         info!(&log, "using system configuration");
-        let async_resolver =
-            trust_dns_resolver::AsyncResolver::tokio_from_system_conf()
-                .context("initializing resolver from system configuration")?;
-        Resolver::new_with_resolver(log.clone(), async_resolver)
+        Resolver::new_from_system_conf(log.clone())
+            .context("initializing resolver from system configuration")?
     } else {
         let addrs = opt.nameserver_addresses;
         info!(&log, "using explicit nameservers"; "nameservers" => ?addrs);
diff --git a/internal-dns/Cargo.toml b/internal-dns/Cargo.toml
index c08cc012c1..c12035e2cb 100644
--- a/internal-dns/Cargo.toml
+++ b/internal-dns/Cargo.toml
@@ -18,7 +18,7 @@ omicron-uuid-kinds.workspace = true
 reqwest = { workspace = true, features = ["rustls-tls", "stream"] }
 slog.workspace = true
 thiserror.workspace = true
-trust-dns-resolver.workspace = true
+hickory-resolver.workspace = true
 uuid.workspace = true
 omicron-workspace-hack.workspace = true
 
diff --git a/internal-dns/src/resolver.rs b/internal-dns/src/resolver.rs
index fdd5dce428..b3dadf16d2 100644
--- a/internal-dns/src/resolver.rs
+++ b/internal-dns/src/resolver.rs
@@ -2,24 +2,24 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
+use hickory_resolver::config::{
+    LookupIpStrategy, NameServerConfig, Protocol, ResolverConfig, ResolverOpts,
+};
+use hickory_resolver::lookup::SrvLookup;
+use hickory_resolver::TokioAsyncResolver;
 use hyper::client::connect::dns::Name;
 use omicron_common::address::{
     Ipv6Subnet, ReservedRackSubnet, AZ_PREFIX, DNS_PORT,
 };
 use slog::{debug, error, info, trace};
 use std::net::{IpAddr, Ipv6Addr, SocketAddr, SocketAddrV6};
-use trust_dns_resolver::config::{
-    LookupIpStrategy, NameServerConfig, Protocol, ResolverConfig, ResolverOpts,
-};
-use trust_dns_resolver::lookup::SrvLookup;
-use trust_dns_resolver::TokioAsyncResolver;
 
 pub type DnsError = dns_service_client::Error<dns_service_client::types::Error>;
 
 #[derive(Debug, Clone, thiserror::Error)]
 pub enum ResolveError {
     #[error(transparent)]
-    Resolve(#[from] trust_dns_resolver::error::ResolveError),
+    Resolve(#[from] hickory_resolver::error::ResolveError),
 
     #[error("Record not found for SRV key: {}", .0.dns_name())]
     NotFound(crate::ServiceName),
@@ -52,6 +52,19 @@ impl reqwest::dns::Resolve for Resolver {
 }
 
 impl Resolver {
+    /// Construct a new DNS resolver from the system configuration.
+    pub fn new_from_system_conf(
+        log: slog::Logger,
+    ) -> Result<Self, ResolveError> {
+        let (rc, mut opts) = hickory_resolver::system_conf::read_system_conf()?;
+        // Enable edns for potentially larger records
+        opts.edns0 = true;
+
+        let resolver = TokioAsyncResolver::tokio(rc, opts);
+
+        Ok(Self { log, resolver })
+    }
+
     /// Construct a new DNS resolver from specific DNS server addresses.
     pub fn new_from_addrs(
         log: slog::Logger,
@@ -66,18 +79,20 @@ impl Resolver {
                 socket_addr,
                 protocol: Protocol::Udp,
                 tls_dns_name: None,
-                trust_nx_responses: false,
+                trust_negative_responses: false,
                 bind_addr: None,
             });
         }
         let mut opts = ResolverOpts::default();
+        // Enable edns for potentially larger records
+        opts.edns0 = true;
         opts.use_hosts_file = false;
         opts.num_concurrent_reqs = dns_server_count;
         // The underlay is IPv6 only, so this helps avoid needless lookups of
         // the IPv4 variant.
         opts.ip_strategy = LookupIpStrategy::Ipv6Only;
         opts.negative_max_ttl = Some(std::time::Duration::from_secs(15));
-        let resolver = TokioAsyncResolver::tokio(rc, opts)?;
+        let resolver = TokioAsyncResolver::tokio(rc, opts);
 
         Ok(Self { log, resolver })
     }
@@ -163,7 +178,7 @@ impl Resolver {
             .iter()
             .next()
             .ok_or_else(|| ResolveError::NotFound(srv))?;
-        Ok(*address)
+        Ok(address.0)
     }
 
     /// Returns the targets of the SRV records for a DNS name
@@ -313,7 +328,7 @@ impl Resolver {
     //   (1) it returns `IpAddr`'s rather than `SocketAddr`'s
     //   (2) it doesn't actually return all the addresses from the Additional
     //       section of the DNS server's response.
-    //       See bluejekyll/trust-dns#1980
+    //       See hickory-dns/hickory-dns#1980
     //
     // (1) is not a huge deal as we can try to match up the targets ourselves
     // to grab the port for creating a `SocketAddr` but (2) means we need to do
@@ -350,10 +365,9 @@ impl Resolver {
             .await
             .into_iter()
             .flat_map(move |target| match target {
-                Ok((ips, port)) => Some(
-                    ips.into_iter()
-                        .map(move |ip| SocketAddrV6::new(ip, port, 0, 0)),
-                ),
+                Ok((ips, port)) => Some(ips.into_iter().map(move |aaaa| {
+                    SocketAddrV6::new(aaaa.into(), port, 0, 0)
+                })),
                 Err((target, err)) => {
                     error!(
                         log,
@@ -511,7 +525,7 @@ mod test {
         assert!(
             matches!(
                 dns_error.kind(),
-                trust_dns_resolver::error::ResolveErrorKind::NoRecordsFound { .. },
+                hickory_resolver::error::ResolveErrorKind::NoRecordsFound { .. },
             ),
             "Saw error: {dns_error}",
         );
@@ -664,7 +678,7 @@ mod test {
             error,
             ResolveError::Resolve(error)
                 if matches!(error.kind(),
-                    trust_dns_resolver::error::ResolveErrorKind::NoRecordsFound { .. }
+                    hickory_resolver::error::ResolveErrorKind::NoRecordsFound { .. }
                 )
         );
 
diff --git a/nexus/Cargo.toml b/nexus/Cargo.toml
index 1128cd8f0f..8977507505 100644
--- a/nexus/Cargo.toml
+++ b/nexus/Cargo.toml
@@ -35,6 +35,7 @@ futures.workspace = true
 gateway-client.workspace = true
 headers.workspace = true
 hex.workspace = true
+hickory-resolver.workspace = true
 http.workspace = true
 hyper.workspace = true
 illumos-utils.workspace = true
@@ -87,7 +88,6 @@ tokio = { workspace = true, features = ["full"] }
 tokio-postgres = { workspace = true, features = ["with-serde_json-1"] }
 tokio-util = { workspace = true, features = ["codec"] }
 tough.workspace = true
-trust-dns-resolver.workspace = true
 uuid.workspace = true
 
 nexus-auth.workspace = true
@@ -143,7 +143,7 @@ sp-sim.workspace = true
 rustls.workspace = true
 subprocess.workspace = true
 term.workspace = true
-trust-dns-resolver.workspace = true
+hickory-resolver.workspace = true
 tufaceous.workspace = true
 tufaceous-lib.workspace = true
 httptest.workspace = true
diff --git a/nexus/src/app/external_dns.rs b/nexus/src/app/external_dns.rs
index c6a8d833c2..4732146ce2 100644
--- a/nexus/src/app/external_dns.rs
+++ b/nexus/src/app/external_dns.rs
@@ -5,15 +5,15 @@
 use std::net::IpAddr;
 use std::net::SocketAddr;
 
+use hickory_resolver::config::NameServerConfig;
+use hickory_resolver::config::Protocol;
+use hickory_resolver::config::ResolverConfig;
+use hickory_resolver::config::ResolverOpts;
+use hickory_resolver::TokioAsyncResolver;
 use hyper::client::connect::dns::Name;
 use omicron_common::address::DNS_PORT;
-use trust_dns_resolver::config::NameServerConfig;
-use trust_dns_resolver::config::Protocol;
-use trust_dns_resolver::config::ResolverConfig;
-use trust_dns_resolver::config::ResolverOpts;
-use trust_dns_resolver::TokioAsyncResolver;
 
-/// Wrapper around trust-dns-resolver to provide name resolution
+/// Wrapper around hickory-resolver to provide name resolution
 /// using a given set of DNS servers for use with reqwest.
 pub struct Resolver(TokioAsyncResolver);
 
@@ -26,18 +26,17 @@ impl Resolver {
                 socket_addr: SocketAddr::new(*addr, DNS_PORT),
                 protocol: Protocol::Udp,
                 tls_dns_name: None,
-                trust_nx_responses: false,
+                trust_negative_responses: false,
                 bind_addr: None,
             });
         }
         let mut opts = ResolverOpts::default();
+        // Enable edns for potentially larger records
+        opts.edns0 = true;
         opts.use_hosts_file = false;
         // Do as many requests in parallel as we have configured servers
         opts.num_concurrent_reqs = dns_servers.len();
-        Resolver(
-            TokioAsyncResolver::tokio(rc, opts)
-                .expect("creating resovler shouldn't fail"),
-        )
+        Resolver(TokioAsyncResolver::tokio(rc, opts))
     }
 }
 
@@ -48,7 +47,7 @@ impl reqwest::dns::Resolve for Resolver {
             let ips = resolver.lookup_ip(name.as_str()).await?;
             let addrs = ips
                 .into_iter()
-                // trust-dns-resolver returns `IpAddr`s but reqwest wants
+                // hickory-resolver returns `IpAddr`s but reqwest wants
                 // `SocketAddr`s (useful if you have a custom resolver that
                 // returns a scoped IPv6 address). The port provided here
                 // is ignored in favour of the scheme default (http/80,
diff --git a/nexus/test-utils/Cargo.toml b/nexus/test-utils/Cargo.toml
index a883bc83c5..50110ecaca 100644
--- a/nexus/test-utils/Cargo.toml
+++ b/nexus/test-utils/Cargo.toml
@@ -46,7 +46,7 @@ sled-agent-client.workspace = true
 slog.workspace = true
 tokio.workspace = true
 tokio-util.workspace = true
-trust-dns-resolver.workspace = true
+hickory-resolver.workspace = true
 uuid.workspace = true
 omicron-workspace-hack.workspace = true
 
diff --git a/nexus/test-utils/src/lib.rs b/nexus/test-utils/src/lib.rs
index 7c190974a1..3dcffb399b 100644
--- a/nexus/test-utils/src/lib.rs
+++ b/nexus/test-utils/src/lib.rs
@@ -17,6 +17,11 @@ use dropshot::HandlerTaskMode;
 use futures::future::BoxFuture;
 use futures::FutureExt;
 use gateway_test_utils::setup::GatewayTestContext;
+use hickory_resolver::config::NameServerConfig;
+use hickory_resolver::config::Protocol;
+use hickory_resolver::config::ResolverConfig;
+use hickory_resolver::config::ResolverOpts;
+use hickory_resolver::TokioAsyncResolver;
 use nexus_config::Database;
 use nexus_config::DpdConfig;
 use nexus_config::InternalDns;
@@ -73,11 +78,6 @@ use std::collections::HashMap;
 use std::fmt::Debug;
 use std::net::{IpAddr, Ipv6Addr, SocketAddr, SocketAddrV6};
 use std::time::Duration;
-use trust_dns_resolver::config::NameServerConfig;
-use trust_dns_resolver::config::Protocol;
-use trust_dns_resolver::config::ResolverConfig;
-use trust_dns_resolver::config::ResolverOpts;
-use trust_dns_resolver::TokioAsyncResolver;
 use uuid::Uuid;
 
 pub use sim::TEST_HARDWARE_THREADS;
@@ -1586,12 +1586,12 @@ pub async fn start_dns_server(
         socket_addr: dns_server.local_address(),
         protocol: Protocol::Udp,
         tls_dns_name: None,
-        trust_nx_responses: false,
+        trust_negative_responses: false,
         bind_addr: None,
     });
-    let resolver =
-        TokioAsyncResolver::tokio(resolver_config, ResolverOpts::default())
-            .context("creating DNS resolver")?;
+    let mut resolver_opts = ResolverOpts::default();
+    resolver_opts.edns0 = true;
+    let resolver = TokioAsyncResolver::tokio(resolver_config, resolver_opts);
 
     Ok((dns_server, http_server, resolver))
 }
diff --git a/nexus/tests/integration_tests/silos.rs b/nexus/tests/integration_tests/silos.rs
index 2c861ff159..0de4d31395 100644
--- a/nexus/tests/integration_tests/silos.rs
+++ b/nexus/tests/integration_tests/silos.rs
@@ -37,6 +37,7 @@ use std::fmt::Write;
 use std::str::FromStr;
 
 use base64::Engine;
+use hickory_resolver::error::ResolveErrorKind;
 use http::method::Method;
 use http::StatusCode;
 use httptest::{matchers::*, responders::*, Expectation, Server};
@@ -44,7 +45,6 @@ use nexus_types::external_api::shared::{FleetRole, SiloRole};
 use std::convert::Infallible;
 use std::net::Ipv4Addr;
 use std::time::Duration;
-use trust_dns_resolver::error::ResolveErrorKind;
 use uuid::Uuid;
 
 type ControlPlaneTestContext =
@@ -2164,7 +2164,7 @@ pub async fn verify_silo_dns_name(
                 .await
             {
                 Ok(result) => {
-                    let addrs: Vec<_> = result.iter().collect();
+                    let addrs: Vec<_> = result.iter().map(|a| &a.0).collect();
                     if addrs.is_empty() {
                         false
                     } else {
diff --git a/wicketd/Cargo.toml b/wicketd/Cargo.toml
index 324ae01b42..6e2c27a97e 100644
--- a/wicketd/Cargo.toml
+++ b/wicketd/Cargo.toml
@@ -25,6 +25,7 @@ flume.workspace = true
 futures.workspace = true
 gateway-messages.workspace = true
 hex.workspace = true
+hickory-resolver.workspace = true
 http.workspace = true
 hubtools.workspace = true
 hyper.workspace = true
@@ -46,7 +47,6 @@ tokio-stream.workspace = true
 tokio-util.workspace = true
 toml.workspace = true
 tough.workspace = true
-trust-dns-resolver.workspace = true
 uuid.workspace = true
 
 bootstrap-agent-client.workspace = true
diff --git a/wicketd/src/preflight_check/uplink.rs b/wicketd/src/preflight_check/uplink.rs
index 36a4f61779..fb0914e836 100644
--- a/wicketd/src/preflight_check/uplink.rs
+++ b/wicketd/src/preflight_check/uplink.rs
@@ -14,6 +14,11 @@ use dpd_client::types::PortSpeed as DpdPortSpeed;
 use dpd_client::Client as DpdClient;
 use dpd_client::ClientState as DpdClientState;
 use either::Either;
+use hickory_resolver::config::NameServerConfigGroup;
+use hickory_resolver::config::ResolverConfig;
+use hickory_resolver::config::ResolverOpts;
+use hickory_resolver::error::ResolveErrorKind;
+use hickory_resolver::TokioAsyncResolver;
 use illumos_utils::zone::SVCCFG;
 use illumos_utils::PFEXEC;
 use omicron_common::address::DENDRITE_PORT;
@@ -35,12 +40,6 @@ use std::time::Duration;
 use std::time::Instant;
 use tokio::process::Command;
 use tokio::sync::mpsc;
-use trust_dns_resolver::config::NameServerConfigGroup;
-use trust_dns_resolver::config::ResolverConfig;
-use trust_dns_resolver::config::ResolverOpts;
-use trust_dns_resolver::error::ResolveError;
-use trust_dns_resolver::error::ResolveErrorKind;
-use trust_dns_resolver::TokioAsyncResolver;
 use wicket_common::preflight_check::EventBuffer;
 use wicket_common::preflight_check::StepContext;
 use wicket_common::preflight_check::StepProgress;
@@ -930,16 +929,7 @@ impl DnsLookupStep {
         };
 
         'dns_servers: for &dns_ip in dns_servers {
-            let resolver = match self.build_resolver(dns_ip) {
-                Ok(resolver) => resolver,
-                Err(err) => {
-                    self.warnings.push(format!(
-                        "failed to create resolver for {dns_ip}: {}",
-                        DisplayErrorChain::new(&err)
-                    ));
-                    continue;
-                }
-            };
+            let resolver = self.build_resolver(dns_ip);
 
             // Attempt to resolve any NTP servers that aren't IP addresses.
             for &ntp_name in &ntp_names_to_resolve {
@@ -1052,14 +1042,18 @@ impl DnsLookupStep {
                 (
                     "A",
                     resolver.ipv4_lookup(name).await.map(|records| {
-                        Either::Left(records.into_iter().map(IpAddr::V4))
+                        Either::Left(
+                            records.into_iter().map(|x| IpAddr::V4(x.into())),
+                        )
                     }),
                 )
             } else {
                 (
                     "AAAA",
                     resolver.ipv6_lookup(name).await.map(|records| {
-                        Either::Right(records.into_iter().map(IpAddr::V6))
+                        Either::Right(
+                            records.into_iter().map(|x| IpAddr::V6(x.into())),
+                        )
                     }),
                 )
             };
@@ -1175,12 +1169,12 @@ impl DnsLookupStep {
     ///
     /// If building it fails, we'll append to our internal `warnings` and return
     /// `None`.
-    fn build_resolver(
-        &mut self,
-        dns_ip: IpAddr,
-    ) -> Result<TokioAsyncResolver, ResolveError> {
+    fn build_resolver(&mut self, dns_ip: IpAddr) -> TokioAsyncResolver {
         let mut options = ResolverOpts::default();
 
+        // Enable edns for potentially larger records
+        options.edns0 = true;
+
         // We will retry ourselves; we don't want the resolver
         // retrying internally too.
         options.attempts = 1;
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index 35c266cdf3..5edfbccf93 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -60,6 +60,7 @@ getrandom = { version = "0.2.14", default-features = false, features = ["js", "r
 group = { version = "0.13.0", default-features = false, features = ["alloc"] }
 hashbrown = { version = "0.14.5", features = ["raw"] }
 hex = { version = "0.4.3", features = ["serde"] }
+hickory-proto = { version = "0.24.1", features = ["text-parsing"] }
 hmac = { version = "0.12.1", default-features = false, features = ["reset"] }
 hyper = { version = "0.14.30", features = ["full"] }
 indexmap = { version = "2.4.0", features = ["serde"] }
@@ -113,7 +114,6 @@ tokio-util = { version = "0.7.11", features = ["codec", "io-util"] }
 toml = { version = "0.7.8" }
 toml_edit-3c51e837cfc5589a = { package = "toml_edit", version = "0.22.20", features = ["serde"] }
 tracing = { version = "0.1.40", features = ["log"] }
-trust-dns-proto = { version = "0.22.0" }
 unicode-bidi = { version = "0.3.15" }
 unicode-normalization = { version = "0.1.23" }
 usdt = { version = "0.5.0" }
@@ -167,6 +167,7 @@ getrandom = { version = "0.2.14", default-features = false, features = ["js", "r
 group = { version = "0.13.0", default-features = false, features = ["alloc"] }
 hashbrown = { version = "0.14.5", features = ["raw"] }
 hex = { version = "0.4.3", features = ["serde"] }
+hickory-proto = { version = "0.24.1", features = ["text-parsing"] }
 hmac = { version = "0.12.1", default-features = false, features = ["reset"] }
 hyper = { version = "0.14.30", features = ["full"] }
 indexmap = { version = "2.4.0", features = ["serde"] }
@@ -222,7 +223,6 @@ tokio-util = { version = "0.7.11", features = ["codec", "io-util"] }
 toml = { version = "0.7.8" }
 toml_edit-3c51e837cfc5589a = { package = "toml_edit", version = "0.22.20", features = ["serde"] }
 tracing = { version = "0.1.40", features = ["log"] }
-trust-dns-proto = { version = "0.22.0" }
 unicode-bidi = { version = "0.3.15" }
 unicode-normalization = { version = "0.1.23" }
 unicode-xid = { version = "0.2.4" }