diff --git a/packages/conformance-tests/src/resolver/dns/scenarios.rs b/packages/conformance-tests/src/resolver/dns/scenarios.rs
index 39470b83..20a90d07 100644
--- a/packages/conformance-tests/src/resolver/dns/scenarios.rs
+++ b/packages/conformance-tests/src/resolver/dns/scenarios.rs
@@ -12,11 +12,11 @@ fn can_resolve() -> Result<()> {
     let needle_fqdn = FQDN("example.nameservers.com.")?;
 
     let network = Network::new()?;
-    let mut root_ns = NameServer::new(dns_test::peer(), FQDN::ROOT, &network)?;
-    let mut com_ns = NameServer::new(dns_test::peer(), FQDN::COM, &network)?;
+    let peer = dns_test::peer();
+    let mut root_ns = NameServer::new(&peer, FQDN::ROOT, &network)?;
+    let mut com_ns = NameServer::new(&peer, FQDN::COM, &network)?;
 
-    let mut nameservers_ns =
-        NameServer::new(dns_test::peer(), FQDN("nameservers.com.")?, &network)?;
+    let mut nameservers_ns = NameServer::new(&peer, FQDN("nameservers.com.")?, &network)?;
     nameservers_ns
         .add(Record::a(root_ns.fqdn().clone(), root_ns.ipv4_addr()))
         .add(Record::a(com_ns.fqdn().clone(), com_ns.ipv4_addr()))
@@ -40,7 +40,7 @@ fn can_resolve() -> Result<()> {
     eprintln!("root.zone:\n{}", root_ns.zone_file());
 
     let roots = &[Root::new(root_ns.fqdn().clone(), root_ns.ipv4_addr())];
-    let resolver = Resolver::start(dns_test::subject(), roots, &TrustAnchor::empty(), &network)?;
+    let resolver = Resolver::start(&dns_test::subject(), roots, &TrustAnchor::empty(), &network)?;
     let resolver_ip_addr = resolver.ipv4_addr();
 
     let client = Client::new(&network)?;
@@ -65,11 +65,11 @@ fn nxdomain() -> Result<()> {
     let needle_fqdn = FQDN("unicorn.nameservers.com.")?;
 
     let network = Network::new()?;
-    let mut root_ns = NameServer::new(dns_test::peer(), FQDN::ROOT, &network)?;
-    let mut com_ns = NameServer::new(dns_test::peer(), FQDN::COM, &network)?;
+    let peer = dns_test::peer();
+    let mut root_ns = NameServer::new(&peer, FQDN::ROOT, &network)?;
+    let mut com_ns = NameServer::new(&peer, FQDN::COM, &network)?;
 
-    let mut nameservers_ns =
-        NameServer::new(dns_test::peer(), FQDN("nameservers.com.")?, &network)?;
+    let mut nameservers_ns = NameServer::new(&peer, FQDN("nameservers.com.")?, &network)?;
     nameservers_ns
         .add(Record::a(root_ns.fqdn().clone(), root_ns.ipv4_addr()))
         .add(Record::a(com_ns.fqdn().clone(), com_ns.ipv4_addr()));
@@ -86,7 +86,7 @@ fn nxdomain() -> Result<()> {
     let root_ns = root_ns.start()?;
 
     let roots = &[Root::new(root_ns.fqdn().clone(), root_ns.ipv4_addr())];
-    let resolver = Resolver::start(dns_test::subject(), roots, &TrustAnchor::empty(), &network)?;
+    let resolver = Resolver::start(&dns_test::subject(), roots, &TrustAnchor::empty(), &network)?;
     let resolver_ip_addr = resolver.ipv4_addr();
 
     let client = Client::new(&network)?;
diff --git a/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_4/section_4_1.rs b/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_4/section_4_1.rs
index 233ea95c..12a3e7c4 100644
--- a/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_4/section_4_1.rs
+++ b/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_4/section_4_1.rs
@@ -9,9 +9,9 @@ use dns_test::{Network, Resolver, Result, TrustAnchor, FQDN};
 #[ignore]
 fn edns_support() -> Result<()> {
     let network = &Network::new()?;
-    let ns = NameServer::new(dns_test::peer(), FQDN::ROOT, network)?.start()?;
+    let ns = NameServer::new(&dns_test::peer(), FQDN::ROOT, network)?.start()?;
     let resolver = Resolver::start(
-        dns_test::subject(),
+        &dns_test::subject(),
         &[Root::new(ns.fqdn().clone(), ns.ipv4_addr())],
         &TrustAnchor::empty(),
         network,
diff --git a/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs b/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs
index 40011547..0dd99b51 100644
--- a/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs
+++ b/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs
@@ -15,10 +15,10 @@ fn bad_signature_in_leaf_nameserver() -> Result<()> {
 
     let network = Network::new()?;
     let peer = dns_test::peer();
-    let mut root_ns = NameServer::new(peer.clone(), FQDN::ROOT, &network)?;
-    let mut com_ns = NameServer::new(peer.clone(), FQDN::COM, &network)?;
+    let mut root_ns = NameServer::new(&peer, FQDN::ROOT, &network)?;
+    let mut com_ns = NameServer::new(&peer, FQDN::COM, &network)?;
 
-    let mut nameservers_ns = NameServer::new(peer, FQDN("nameservers.com.")?, &network)?;
+    let mut nameservers_ns = NameServer::new(&peer, FQDN("nameservers.com.")?, &network)?;
     nameservers_ns
         .add(Record::a(root_ns.fqdn().clone(), root_ns.ipv4_addr()))
         .add(Record::a(com_ns.fqdn().clone(), com_ns.ipv4_addr()))
@@ -67,7 +67,7 @@ fn bad_signature_in_leaf_nameserver() -> Result<()> {
     let roots = &[Root::new(root_ns.fqdn().clone(), root_ns.ipv4_addr())];
 
     let trust_anchor = TrustAnchor::from_iter([root_ksk.clone(), root_zsk.clone()]);
-    let resolver = Resolver::start(dns_test::subject(), roots, &trust_anchor, &network)?;
+    let resolver = Resolver::start(&dns_test::subject(), roots, &trust_anchor, &network)?;
     let resolver_addr = resolver.ipv4_addr();
 
     let client = Client::new(&network)?;
diff --git a/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs b/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs
index b3571ce2..6df21009 100644
--- a/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs
+++ b/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs
@@ -11,7 +11,7 @@ use dns_test::{Network, Resolver, Result, TrustAnchor, FQDN};
 #[test]
 fn can_validate_without_delegation() -> Result<()> {
     let network = Network::new()?;
-    let mut ns = NameServer::new(dns_test::peer(), FQDN::ROOT, &network)?;
+    let mut ns = NameServer::new(&dns_test::peer(), FQDN::ROOT, &network)?;
     ns.add(Record::a(ns.fqdn().clone(), ns.ipv4_addr()));
     let ns = ns.sign()?;
 
@@ -27,7 +27,7 @@ fn can_validate_without_delegation() -> Result<()> {
     let roots = &[Root::new(ns.fqdn().clone(), ns.ipv4_addr())];
 
     let trust_anchor = TrustAnchor::from_iter([root_ksk.clone(), root_zsk.clone()]);
-    let resolver = Resolver::start(dns_test::subject(), roots, &trust_anchor, &network)?;
+    let resolver = Resolver::start(&dns_test::subject(), roots, &trust_anchor, &network)?;
     let resolver_addr = resolver.ipv4_addr();
 
     let client = Client::new(&network)?;
@@ -51,10 +51,10 @@ fn can_validate_with_delegation() -> Result<()> {
 
     let peer = dns_test::peer();
     let network = Network::new()?;
-    let mut root_ns = NameServer::new(peer.clone(), FQDN::ROOT, &network)?;
-    let mut com_ns = NameServer::new(peer.clone(), FQDN::COM, &network)?;
+    let mut root_ns = NameServer::new(&peer, FQDN::ROOT, &network)?;
+    let mut com_ns = NameServer::new(&peer, FQDN::COM, &network)?;
 
-    let mut nameservers_ns = NameServer::new(peer, FQDN("nameservers.com.")?, &network)?;
+    let mut nameservers_ns = NameServer::new(&peer, FQDN("nameservers.com.")?, &network)?;
     nameservers_ns
         .add(Record::a(root_ns.fqdn().clone(), root_ns.ipv4_addr()))
         .add(Record::a(com_ns.fqdn().clone(), com_ns.ipv4_addr()))
@@ -94,7 +94,7 @@ fn can_validate_with_delegation() -> Result<()> {
     let roots = &[Root::new(root_ns.fqdn().clone(), root_ns.ipv4_addr())];
 
     let trust_anchor = TrustAnchor::from_iter([root_ksk.clone(), root_zsk.clone()]);
-    let resolver = Resolver::start(dns_test::subject(), roots, &trust_anchor, &network)?;
+    let resolver = Resolver::start(&dns_test::subject(), roots, &trust_anchor, &network)?;
     let resolver_addr = resolver.ipv4_addr();
 
     let client = Client::new(&network)?;
diff --git a/packages/dns-test/examples/explore.rs b/packages/dns-test/examples/explore.rs
index e6d9919e..038870a1 100644
--- a/packages/dns-test/examples/explore.rs
+++ b/packages/dns-test/examples/explore.rs
@@ -11,13 +11,13 @@ fn main() -> Result<()> {
     let peer = dns_test::peer();
 
     println!("building docker image...");
-    let mut root_ns = NameServer::new(peer.clone(), FQDN::ROOT, &network)?;
+    let mut root_ns = NameServer::new(&peer, FQDN::ROOT, &network)?;
     println!("DONE");
 
     println!("setting up name servers...");
-    let mut com_ns = NameServer::new(peer.clone(), FQDN::COM, &network)?;
+    let mut com_ns = NameServer::new(&peer, FQDN::COM, &network)?;
 
-    let mut nameservers_ns = NameServer::new(peer.clone(), FQDN("nameservers.com.")?, &network)?;
+    let mut nameservers_ns = NameServer::new(&peer, FQDN("nameservers.com.")?, &network)?;
     nameservers_ns
         .add(Record::a(root_ns.fqdn().clone(), root_ns.ipv4_addr()))
         .add(Record::a(com_ns.fqdn().clone(), com_ns.ipv4_addr()));
@@ -50,7 +50,7 @@ fn main() -> Result<()> {
 
     let trust_anchor = TrustAnchor::from_iter([root_ksk.clone(), root_zsk.clone()]);
     println!("building docker image...");
-    let resolver = Resolver::start(dns_test::subject(), roots, &trust_anchor, &network)?;
+    let resolver = Resolver::start(&dns_test::subject(), roots, &trust_anchor, &network)?;
     println!("DONE\n\n");
 
     let resolver_addr = resolver.ipv4_addr();
diff --git a/packages/dns-test/src/name_server.rs b/packages/dns-test/src/name_server.rs
index 5015ab74..e5732c2b 100644
--- a/packages/dns-test/src/name_server.rs
+++ b/packages/dns-test/src/name_server.rs
@@ -26,7 +26,7 @@ impl NameServer<Stopped> {
     /// - one SOA record, with the primary name server field set to this name server's FQDN
     /// - one NS record, with this name server's FQDN set as the only available name server for
     /// the zone
-    pub fn new(implementation: Implementation, zone: FQDN, network: &Network) -> Result<Self> {
+    pub fn new(implementation: &Implementation, zone: FQDN, network: &Network) -> Result<Self> {
         assert!(
             matches!(implementation, Implementation::Unbound),
             "currently only `unbound` (`nsd`) can be used as a `NameServer`"
@@ -46,7 +46,7 @@ impl NameServer<Stopped> {
 
         zone_file.add(Record::ns(zone, nameserver.clone()));
 
-        let image = implementation.into();
+        let image = implementation.clone().into();
         Ok(Self {
             container: Container::run(&image, network)?,
             zone_file,
@@ -303,7 +303,7 @@ mod tests {
     #[test]
     fn simplest() -> Result<()> {
         let network = Network::new()?;
-        let tld_ns = NameServer::new(Implementation::Unbound, FQDN::COM, &network)?.start()?;
+        let tld_ns = NameServer::new(&Implementation::Unbound, FQDN::COM, &network)?.start()?;
         let ip_addr = tld_ns.ipv4_addr();
 
         let client = Client::new(&network)?;
@@ -318,7 +318,7 @@ mod tests {
     fn with_referral() -> Result<()> {
         let network = Network::new()?;
         let expected_ip_addr = Ipv4Addr::new(172, 17, 200, 1);
-        let mut root_ns = NameServer::new(Implementation::Unbound, FQDN::ROOT, &network)?;
+        let mut root_ns = NameServer::new(&Implementation::Unbound, FQDN::ROOT, &network)?;
         root_ns.referral(
             FQDN::COM,
             FQDN("primary.tld-server.com.")?,
@@ -346,7 +346,7 @@ mod tests {
     #[test]
     fn signed() -> Result<()> {
         let network = Network::new()?;
-        let ns = NameServer::new(Implementation::Unbound, FQDN::ROOT, &network)?.sign()?;
+        let ns = NameServer::new(&Implementation::Unbound, FQDN::ROOT, &network)?.sign()?;
 
         eprintln!("KSK:\n{}", ns.key_signing_key());
         eprintln!("ZSK:\n{}", ns.zone_signing_key());
@@ -377,7 +377,7 @@ mod tests {
     #[test]
     fn terminate_works() -> Result<()> {
         let network = Network::new()?;
-        let ns = NameServer::new(Implementation::Unbound, FQDN::ROOT, &network)?.start()?;
+        let ns = NameServer::new(&Implementation::Unbound, FQDN::ROOT, &network)?.start()?;
         let logs = ns.terminate()?;
 
         assert!(logs.contains("nsd starting"));
diff --git a/packages/dns-test/src/resolver.rs b/packages/dns-test/src/resolver.rs
index 22c5e55a..813e3bc3 100644
--- a/packages/dns-test/src/resolver.rs
+++ b/packages/dns-test/src/resolver.rs
@@ -21,7 +21,7 @@ impl Resolver {
     ///
     /// This constructor panics if `roots` is an empty slice
     pub fn start(
-        implementation: Implementation,
+        implementation: &Implementation,
         roots: &[Root],
         trust_anchor: &TrustAnchor,
         network: &Network,
@@ -125,9 +125,9 @@ mod tests {
     #[test]
     fn terminate_works() -> Result<()> {
         let network = Network::new()?;
-        let ns = NameServer::new(Implementation::Unbound, FQDN::ROOT, &network)?.start()?;
+        let ns = NameServer::new(&Implementation::Unbound, FQDN::ROOT, &network)?.start()?;
         let resolver = Resolver::start(
-            Implementation::Unbound,
+            &Implementation::Unbound,
             &[Root::new(ns.fqdn().clone(), ns.ipv4_addr())],
             &TrustAnchor::empty(),
             &network,
diff --git a/packages/dns-test/src/tshark.rs b/packages/dns-test/src/tshark.rs
index 0aef4397..e736ea9d 100644
--- a/packages/dns-test/src/tshark.rs
+++ b/packages/dns-test/src/tshark.rs
@@ -255,7 +255,7 @@ mod tests {
     #[test]
     fn nameserver() -> Result<()> {
         let network = &Network::new()?;
-        let ns = NameServer::new(Implementation::Unbound, FQDN::ROOT, network)?.start()?;
+        let ns = NameServer::new(&Implementation::Unbound, FQDN::ROOT, network)?.start()?;
         let mut tshark = ns.eavesdrop()?;
 
         let client = Client::new(network)?;
@@ -290,11 +290,11 @@ mod tests {
     #[test]
     fn resolver() -> Result<()> {
         let network = &Network::new()?;
-        let mut root_ns = NameServer::new(Implementation::Unbound, FQDN::ROOT, network)?;
-        let mut com_ns = NameServer::new(Implementation::Unbound, FQDN::COM, network)?;
+        let mut root_ns = NameServer::new(&Implementation::Unbound, FQDN::ROOT, network)?;
+        let mut com_ns = NameServer::new(&Implementation::Unbound, FQDN::COM, network)?;
 
         let mut nameservers_ns =
-            NameServer::new(Implementation::Unbound, FQDN("nameservers.com.")?, network)?;
+            NameServer::new(&Implementation::Unbound, FQDN("nameservers.com.")?, network)?;
         nameservers_ns
             .add(Record::a(root_ns.fqdn().clone(), root_ns.ipv4_addr()))
             .add(Record::a(com_ns.fqdn().clone(), com_ns.ipv4_addr()));
@@ -312,7 +312,7 @@ mod tests {
 
         let roots = &[Root::new(root_ns.fqdn().clone(), root_ns.ipv4_addr())];
         let resolver = Resolver::start(
-            Implementation::Unbound,
+            &Implementation::Unbound,
             roots,
             &TrustAnchor::empty(),
             network,