diff --git a/src/app/config/resolve_addr.c b/src/app/config/resolve_addr.c
index 7368b019d6..df9af231bf 100644
--- a/src/app/config/resolve_addr.c
+++ b/src/app/config/resolve_addr.c
@@ -733,3 +733,13 @@ is_local_to_resolve_addr, (const tor_addr_t *addr))
     return false;
   }
 }
+
+#ifdef TOR_UNIT_TESTS
+
+void
+resolve_addr_reset_suggested(int family)
+{
+  tor_addr_make_unspec(&last_suggested_addrs[af_to_idx(family)]);
+}
+
+#endif /* TOR_UNIT_TESTS */
diff --git a/src/app/config/resolve_addr.h b/src/app/config/resolve_addr.h
index d9a3e28924..369f621fa9 100644
--- a/src/app/config/resolve_addr.h
+++ b/src/app/config/resolve_addr.h
@@ -33,6 +33,12 @@ MOCK_DECL(bool, is_local_to_resolve_addr, (const tor_addr_t *addr));
 
 #ifdef RESOLVE_ADDR_PRIVATE
 
+#ifdef TOR_UNIT_TESTS
+
+void resolve_addr_reset_suggested(int family);
+
+#endif /* TOR_UNIT_TESTS */
+
 #endif /* RESOLVE_ADDR_PRIVATE */
 
 #endif /* TOR_CONFIG_RESOLVE_ADDR_H */
diff --git a/src/test/test_relay.c b/src/test/test_relay.c
index 060ca1b75d..98b407feb3 100644
--- a/src/test/test_relay.c
+++ b/src/test/test_relay.c
@@ -17,6 +17,14 @@
 #include "core/or/cell_st.h"
 #include "core/or/or_circuit_st.h"
 
+#define RESOLVE_ADDR_PRIVATE
+#include "feature/nodelist/dirlist.h"
+#include "feature/relay/relay_find_addr.h"
+#include "feature/relay/routermode.h"
+#include "feature/dirclient/dir_server_st.h"
+
+#include "app/config/resolve_addr.h"
+
 /* Test suite stuff */
 #include "test/test.h"
 #include "test/fakechans.h"
@@ -24,6 +32,13 @@
 
 static void test_relay_append_cell_to_circuit_queue(void *arg);
 
+static int
+mock_server_mode_true(const or_options_t *options)
+{
+  (void) options;
+  return 1;
+}
+
 static void
 assert_circuit_ok_mock(const circuit_t *c)
 {
@@ -192,10 +207,98 @@ test_relay_append_cell_to_circuit_queue(void *arg)
   return;
 }
 
+static void
+test_suggested_address(void *arg)
+{
+  int ret;
+  const char *untrusted_id = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+  dir_server_t *ds = NULL;
+  tor_addr_t ipv4_addr, ipv6_addr, cache_addr;
+  tor_addr_t trusted_addr, untrusted_addr;
+  tor_addr_port_t trusted_ap_v6 = { .port = 443 };
+
+  (void) arg;
+
+  MOCK(server_mode, mock_server_mode_true);
+
+  /* Unstrusted relay source. */
+  ret = tor_addr_parse(&untrusted_addr, "8.8.8.8");
+  tt_int_op(ret, OP_EQ, AF_INET);
+
+  /* Add gabelmoo as a trusted directory authority. */
+  ret = tor_addr_parse(&trusted_addr, "[2001:638:a000:4140::ffff:189]");
+  tt_int_op(ret, OP_EQ, AF_INET6);
+  tor_addr_copy(&trusted_ap_v6.addr, &trusted_addr);
+
+  ds = trusted_dir_server_new("gabelmoo", "131.188.40.189", 80, 443,
+                              &trusted_ap_v6,
+                              "F2044413DAC2E02E3D6BCF4735A19BCA1DE97281",
+                              "ED03BB616EB2F60BEC80151114BB25CEF515B226",
+                              V3_DIRINFO, 1.0);
+  tt_assert(ds);
+  dir_server_add(ds);
+
+  /* 1. Valid IPv4 from a trusted authority (gabelmoo). */
+  ret = tor_addr_parse(&ipv4_addr, "1.2.3.4");
+  relay_address_new_suggestion(&ipv4_addr, &ds->ipv4_addr, ds->digest);
+  resolved_addr_get_suggested(AF_INET, &cache_addr);
+  tt_assert(tor_addr_eq(&cache_addr, &ipv4_addr));
+  resolve_addr_reset_suggested(AF_INET);
+
+  /* 2. Valid IPv6 from a trusted authority (gabelmoo). */
+  ret = tor_addr_parse(&ipv6_addr, "[4242::4242]");
+  relay_address_new_suggestion(&ipv6_addr, &ds->ipv6_addr, ds->digest);
+  resolved_addr_get_suggested(AF_INET6, &cache_addr);
+  tt_assert(tor_addr_eq(&cache_addr, &ipv6_addr));
+  resolve_addr_reset_suggested(AF_INET6);
+
+  /* 3. Valid IPv4 but untrusted source. */
+  ret = tor_addr_parse(&ipv4_addr, "1.2.3.4");
+  relay_address_new_suggestion(&ipv4_addr, &untrusted_addr, untrusted_id);
+  resolved_addr_get_suggested(AF_INET, &cache_addr);
+  tt_assert(tor_addr_is_unspec(&cache_addr));
+
+  /* 4. Valid IPv6 but untrusted source. */
+  ret = tor_addr_parse(&ipv6_addr, "[4242::4242]");
+  relay_address_new_suggestion(&ipv6_addr, &untrusted_addr, untrusted_id);
+  resolved_addr_get_suggested(AF_INET6, &cache_addr);
+  tt_assert(tor_addr_is_unspec(&cache_addr));
+
+  /* 5. Internal IPv4 from a trusted authority (gabelmoo). */
+  ret = tor_addr_parse(&ipv4_addr, "127.0.0.1");
+  relay_address_new_suggestion(&ipv4_addr, &ds->ipv4_addr, ds->digest);
+  resolved_addr_get_suggested(AF_INET, &cache_addr);
+  tt_assert(tor_addr_is_unspec(&cache_addr));
+
+  /* 6. Internal IPv6 from a trusted authority (gabelmoo). */
+  ret = tor_addr_parse(&ipv6_addr, "[::1]");
+  relay_address_new_suggestion(&ipv6_addr, &ds->ipv6_addr, ds->digest);
+  resolved_addr_get_suggested(AF_INET6, &cache_addr);
+  tt_assert(tor_addr_is_unspec(&cache_addr));
+
+  /* 7. IPv4 from a trusted authority (gabelmoo). */
+  relay_address_new_suggestion(&ds->ipv4_addr, &ds->ipv4_addr, ds->digest);
+  resolved_addr_get_suggested(AF_INET, &cache_addr);
+  tt_assert(tor_addr_is_unspec(&cache_addr));
+
+  /* 8. IPv6 from a trusted authority (gabelmoo). */
+  relay_address_new_suggestion(&ds->ipv6_addr, &ds->ipv6_addr, ds->digest);
+  resolved_addr_get_suggested(AF_INET6, &cache_addr);
+  tt_assert(tor_addr_is_unspec(&cache_addr));
+
+ done:
+  dirlist_free_all();
+
+  UNMOCK(server_mode);
+}
+
 struct testcase_t relay_tests[] = {
   { "append_cell_to_circuit_queue", test_relay_append_cell_to_circuit_queue,
     TT_FORK, NULL, NULL },
   { "close_circ_rephist", test_relay_close_circuit,
     TT_FORK, NULL, NULL },
+  { "suggested_address", test_suggested_address,
+    TT_FORK, NULL, NULL },
+
   END_OF_TESTCASES
 };