diff --git a/docs/KNOWN_BUGS b/docs/KNOWN_BUGS
index 754ac03481..7e0313cbeb 100644
--- a/docs/KNOWN_BUGS
+++ b/docs/KNOWN_BUGS
@@ -80,7 +80,6 @@ problems may have been fixed or changed somewhat since this was written.
10.3 FTPS over SOCKS
11. Internals
- 11.1 Curl leaks .onion hostnames in DNS
11.2 error buffer not set if connection to multiple addresses fails
11.4 HTTP test server 'connection-monitor' problems
11.5 Connection information when using TCP Fast Open
@@ -525,14 +524,6 @@ problems may have been fixed or changed somewhat since this was written.
11. Internals
-11.1 Curl leaks .onion hostnames in DNS
-
- Curl sends DNS requests for hostnames with a .onion TLD. This leaks
- information about what the user is attempting to access, and violates this
- requirement of RFC7686: https://datatracker.ietf.org/doc/html/rfc7686
-
- Issue: https://github.com/curl/curl/issues/543
-
11.2 error buffer not set if connection to multiple addresses fails
If you ask libcurl to resolve a hostname like example.com to IPv6 addresses
diff --git a/lib/hostip.c b/lib/hostip.c
index d0dc2e8d5c..2381290fdd 100644
--- a/lib/hostip.c
+++ b/lib/hostip.c
@@ -652,6 +652,14 @@ enum resolve_t Curl_resolv(struct Curl_easy *data,
CURLcode result;
enum resolve_t rc = CURLRESOLV_ERROR; /* default to failure */
struct connectdata *conn = data->conn;
+ /* We should intentionally error and not resolve .onion TLDs */
+ size_t hostname_len = strlen(hostname);
+ if(hostname_len >= 7 &&
+ (curl_strequal(&hostname[hostname_len - 6], ".onion") ||
+ curl_strequal(&hostname[hostname_len - 7], ".onion."))) {
+ failf(data, "Not resolving .onion address (RFC 7686)");
+ return CURLRESOLV_ERROR;
+ }
*entry = NULL;
#ifndef CURL_DISABLE_DOH
conn->bits.doh = FALSE; /* default is not */
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
index f9cca14513..ec51f2b1dc 100644
--- a/tests/data/Makefile.inc
+++ b/tests/data/Makefile.inc
@@ -186,8 +186,8 @@ test1432 test1433 test1434 test1435 test1436 test1437 test1438 test1439 \
test1440 test1441 test1442 test1443 test1444 test1445 test1446 test1447 \
test1448 test1449 test1450 test1451 test1452 test1453 test1454 test1455 \
test1456 test1457 test1458 test1459 test1460 test1461 test1462 test1463 \
-test1464 test1465 test1466 test1467 test1468 test1469 test1470 \
-\
+test1464 test1465 test1466 test1467 test1468 test1469 test1470 test1471 \
+test1472 \
test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
test1516 test1517 test1518 test1519 test1520 test1521 test1522 test1523 \
diff --git a/tests/data/test1471 b/tests/data/test1471
new file mode 100644
index 0000000000..c7c2db6e07
--- /dev/null
+++ b/tests/data/test1471
@@ -0,0 +1,39 @@
+
+
+
+Onion
+Tor
+FAILURE
+
+
+#
+# Server-side
+
+
+
+#
+# Client-side
+
+
+none
+
+
+Fail to resolve .onion TLD
+
+
+red.onion
+
+
+
+#
+# Verify data after the test has been "shot"
+
+# Couldn't resolve host name
+
+6
+
+
+curl: (6) Not resolving .onion address (RFC 7686)
+
+
+
diff --git a/tests/data/test1472 b/tests/data/test1472
new file mode 100644
index 0000000000..9244dd7acb
--- /dev/null
+++ b/tests/data/test1472
@@ -0,0 +1,39 @@
+
+
+
+Onion
+Tor
+FAILURE
+
+
+#
+# Server-side
+
+
+
+#
+# Client-side
+
+
+none
+
+
+Fail to resolve .onion. TLD
+
+
+tasty.onion.
+
+
+
+#
+# Verify data after the test has been "shot"
+
+# Couldn't resolve host name
+
+6
+
+
+curl: (6) Not resolving .onion address (RFC 7686)
+
+
+