diff --git a/ChangeLog b/ChangeLog
index ef96db2dbd..28eaeec44f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -122,7 +122,9 @@ Changes in version 0.1.2.5-xxxx - 200?-??-??
     - Removed the supposedly misleading error message mentioned in Bug #294.
       Patch from Matt Edman.
     - Stop warning when a single nameserver fails: only warn when _all_ of
-      our nameservers have failed.  (Part of a solution to bug #326.)
+      our nameservers have failed.  (Bug #326.)
+    - When we only have one nameserver, raise the threshold for deciding that
+      the nameserver is dead. (Also bug #326)
 
   o Controller features:
     - Have GETINFO dir/status/* work on hosts with DirPort disabled.
diff --git a/doc/TODO b/doc/TODO
index aa08028af5..8ea356ee31 100644
--- a/doc/TODO
+++ b/doc/TODO
@@ -113,18 +113,17 @@ N - DNS improvements
     o Bug 363: Warn and die if we can't find a nameserver and we're running a
       server; don't fall back to 127.0.0.1.
     o Re-check dns when we change IP addresses, rather than every 12 hours
-    . Bug 326: Give fewer error messages from nameservers.
+    o Bug 326: Give fewer error messages from nameservers.
       o Only warn when _all_ nameservers are down; otherwise info.
-      - Increase timeout; what's industry standard?
-        - Alternatively, raise timeout when nameserver dies but comes back
+      D Increase timeout; what's industry standard?
+        D Alternatively, raise timeout when nameserver dies but comes back
           quickly?
-      - Don't believe that our sole nameserver is dead?  or, not until more
+      o Don't believe that our sole nameserver is dead?  or, not until more
         failures than it would take to think one of several nameservers was
         dead?
-        - easy: adjust global_max_nameserver_timeout / global_timeout.
       X Possibly, don't warn until second retry of a nameserver gets no
         answer?
-      - warn if all of your nameservers go down and stay down for like
+      X warn if all of your nameservers go down and stay down for like
         5 minutes.
 R o Take out the '5 second' timeout from the socks detach schedule.
 
diff --git a/src/or/dns.c b/src/or/dns.c
index ca1d60c5bd..212068d4bc 100644
--- a/src/or/dns.c
+++ b/src/or/dns.c
@@ -216,7 +216,7 @@ dns_reset(void)
     resolv_conf_mtime = 0;
   } else {
     if (configure_nameservers(0) < 0)
-      /* XXXX */
+      /* XXXX012 */
       return;
   }
 #else
@@ -651,7 +651,7 @@ dns_resolve(edge_connection_t *exitconn, or_circuit_t *oncirc)
         log_debug(LD_EXIT,"Connection (fd %d) found cached error for %s",
                   exitconn->_base.s,
                   escaped_safe_str(exitconn->_base.address));
-        /*  XXXX send back indication of failure for connect case? -NM*/
+        /*  XXXX012 send back indication of failure for connect case? -NM*/
         if (is_resolve)
           send_resolved_cell(exitconn, oncirc, RESOLVED_TYPE_ERROR);
         circ = circuit_get_by_edge_conn(exitconn);
@@ -853,7 +853,7 @@ add_answer_to_cache(const char *address, int is_reverse, uint32_t addr,
   if (outcome == DNS_RESOLVE_FAILED_TRANSIENT)
     return;
 
-  /* XXX This is dumb, but it seems to workaround a bug I can't find.  We
+  /* XXXX012 This is dumb, but it seems to workaround a bug I can't find.  We
    * should nail this so we can cache reverse DNS answers. -NM */
   if (is_reverse)
     return;
@@ -1525,6 +1525,14 @@ configure_nameservers(int force)
   }
 #endif
 
+  if (evdns_count_nameservers() == 1) {
+    evdns_set_option("max-timeouts:", "16", DNS_OPTIONS_ALL);
+    evdns_set_option("timeout:", "10", DNS_OPTIONS_ALL);
+  } else {
+    evdns_set_option("max-timeouts:", "3", DNS_OPTIONS_ALL);
+    evdns_set_option("timeout:", "5", DNS_OPTIONS_ALL);
+  }
+
   dns_servers_relaunch_checks();
 
   nameservers_configured = 1;