diff --git a/hosts/by-name/servo/services/trust-dns.nix b/hosts/by-name/servo/services/trust-dns.nix
index 0d0269bc..34270f72 100644
--- a/hosts/by-name/servo/services/trust-dns.nix
+++ b/hosts/by-name/servo/services/trust-dns.nix
@@ -46,7 +46,7 @@ in
     # it's best that we keep this identical, or a superset of, what org. lists as our NS.
     # so, org. can specify ns2/ns3 as being to the VPN, with no mention of ns1. we provide ns1 here.
     A."ns1" =    "%ANATIVE%";
-    A."ns2" =    "%AOVPNS%";
+    A."ns2" =    "%ADOOF%";
     A."ns3" =    "%AOVPNS%";
     A."ovpns" =  "%AOVPNS%";
     NS."@" = [
@@ -90,6 +90,7 @@ in
       "%AWAN%" = "$(cat '${dyn-dns.ipPath}')";
       "%CNAMENATIVE%" = "servo.${flavor}";
       "%ANATIVE%" = nativeAddrs."servo.${flavor}";
+      "%ADOOF%" = config.sane.netns.doof.netnsPubIpv4;
       "%AOVPNS%" = config.sane.netns.ovpns.netnsPubIpv4;
     };
   in