diff --git a/net/dns/config.go b/net/dns/config.go
index af3a01d7e..aff502331 100644
--- a/net/dns/config.go
+++ b/net/dns/config.go
@@ -5,6 +5,8 @@
 package dns
 
 import (
+	"sort"
+
 	"inet.af/netaddr"
 )
 
@@ -99,6 +101,7 @@ func (c Config) matchDomains() []string {
 		ret = append(ret, suffix)
 		seen[suffix] = true
 	}
+	sort.Strings(ret)
 	return ret
 }