diff --git a/libc/dns/include/resolv_params.h b/libc/dns/include/resolv_params.h
index 1b9d433..3c07d8a 100644
--- a/libc/dns/include/resolv_params.h
+++ b/libc/dns/include/resolv_params.h
@@ -34,6 +34,10 @@
 					 * servers.
 					 */
 
+/* If EDNS0_PADDING is defined, queries will be padded to a multiple of this length
+when EDNS0 is active. */
+#define EDNS0_PADDING	128
+
 /* per-netid configuration parameters passed from netd to the resolver */
 struct __res_params {
     uint16_t sample_validity; // sample lifetime in s
diff --git a/libc/dns/resolv/res_mkquery.c b/libc/dns/resolv/res_mkquery.c
index c73d588..1b4c4af 100644
--- a/libc/dns/resolv/res_mkquery.c
+++ b/libc/dns/resolv/res_mkquery.c
@@ -269,8 +269,28 @@
 	}
 	ns_put16(flags, cp);
 	cp += INT16SZ;
+#ifdef EDNS0_PADDING
+	{
+		u_int16_t minlen = (cp - buf) + 3 * INT16SZ;
+		u_int16_t extra = minlen % EDNS0_PADDING;
+		u_int16_t padlen = (EDNS0_PADDING - extra) % EDNS0_PADDING;
+		if (minlen > buflen) {
+			return (-1);
+		}
+		padlen = MIN(padlen, buflen - minlen);
+		ns_put16(padlen + 2 * INT16SZ, cp);	/* RDLEN */
+		cp += INT16SZ;
+		ns_put16(NS_OPT_PADDING, cp);	/* OPTION-CODE */
+		cp += INT16SZ;
+		ns_put16(padlen, cp);	/* OPTION-LENGTH */
+		cp += INT16SZ;
+		memset(cp, 0, padlen);
+		cp += padlen;
+	}
+#else
 	ns_put16(0, cp);	/* RDLEN */
 	cp += INT16SZ;
+#endif
 	hp->arcount = htons(ntohs(hp->arcount) + 1);
 
 	return (cp - buf);
diff --git a/libc/include/arpa/nameser.h b/libc/include/arpa/nameser.h
index ffb5250..e0b5c45 100644
--- a/libc/include/arpa/nameser.h
+++ b/libc/include/arpa/nameser.h
@@ -474,6 +474,7 @@
  */
 #define NS_OPT_DNSSEC_OK	0x8000U
 #define NS_OPT_NSID             3
+#define NS_OPT_PADDING          12
 
 /*
  * Inline versions of get/put short/long.  Pointer is advanced.