diff --git a/src/dig.js b/src/dig.js
index f04c60837..dae8aa7dc 100644
--- a/src/dig.js
+++ b/src/dig.js
@@ -6,8 +6,7 @@ exports = module.exports = {
 
 const assert = require('assert'),
     constants = require('./constants.js'),
-    dns = require('dns'),
-    safe = require('safetydance');
+    dns = require('dns');
 
 // a note on TXT records. It doesn't have quotes ("") at the DNS level. Those quotes
 // are added for DNS server software to enclose spaces. Such quotes may also be returned
@@ -15,23 +14,14 @@ const assert = require('assert'),
 async function resolve(hostname, rrtype, options) {
     assert.strictEqual(typeof hostname, 'string');
     assert.strictEqual(typeof rrtype, 'string');
-    assert(options && typeof options === 'object');
+    assert(options && typeof options === 'object'); // { server, timeout }
 
-    const defaultOptions = { server: '127.0.0.1', timeout: 5000 }; // unbound runs on 127.0.0.1
-    const resolver = new dns.promises.Resolver();
-    options = Object.assign({}, defaultOptions, options);
+    const resolver = new dns.promises.Resolver({ timeout: options.timeout || 10000 });
 
     // Only use unbound on a Cloudron
-    if (constants.CLOUDRON) resolver.setServers([ options.server ]);
+    if (constants.CLOUDRON) resolver.setServers([ options.server || '127.0.0.1' ]); // unbound runs on 127.0.0.1
 
-    // should callback with ECANCELLED but looks like we might hit https://github.com/nodejs/node/issues/14814
-    const timerId = setTimeout(resolver.cancel.bind(resolver), options.timeout || 5000);
-
-    const [error, result] = await safe(resolver.resolve(hostname, rrtype));
-    clearTimeout(timerId);
-
-    if (error && error.code === 'ECANCELLED') error.code = 'TIMEOUT';
-    if (error) throw error;
+    const result = await resolver.resolve(hostname, rrtype);
 
     // when you query a random record, it errors with ENOTFOUND. But, if you query a record which has a different type
     // we sometimes get empty array and sometimes ENODATA. for TXT records, result is 2d array of strings
diff --git a/src/dns/waitfordns.js b/src/dns/waitfordns.js
index 70215deed..b7d4b2116 100644
--- a/src/dns/waitfordns.js
+++ b/src/dns/waitfordns.js
@@ -6,6 +6,7 @@ const assert = require('assert'),
     BoxError = require('../boxerror.js'),
     debug = require('debug')('box:dns/waitfordns'),
     dig = require('../dig.js'),
+    dns = require('node:dns'),
     promiseRetry = require('../promise-retry.js'),
     safe = require('safetydance'),
     _ = require('underscore');
@@ -50,7 +51,7 @@ async function isChangeSynced(hostname, type, value, nameserver) {
         const resolver = type === 'A' || type === 'AAAA' ? resolveIp(hostname, type, resolveOptions) : dig.resolve(hostname, 'TXT', resolveOptions);
 
         const [error, answer] = await safe(resolver);
-        if (error && error.code === 'TIMEOUT') {
+        if (error && error.code === dns.TIMEOUT) {
             debug(`isChangeSynced: NS ${nameserver} (${nsIp}) timed out when resolving ${hostname} (${type})`);
             status[i] = true; // should be ok if dns server is down
             continue;