diff --git a/core/java/src/net/i2p/util/DNSOverHTTPS.java b/core/java/src/net/i2p/util/DNSOverHTTPS.java
index 0c10fe04c5b6d479ed78364342e3984e6d35a8ab..70430907fc66291668defc6e8690926021e46565 100644
--- a/core/java/src/net/i2p/util/DNSOverHTTPS.java
+++ b/core/java/src/net/i2p/util/DNSOverHTTPS.java
@@ -52,6 +52,8 @@ public class DNSOverHTTPS implements EepGet.StatusListener {
     // ESR version of Firefox, same as Tor Browser
     private static final String UA_CLEARNET = "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0";
 
+    private static final int MAX_RESPONSE_SIZE = 2048;
+
     // Don't look up any of these TLDs
     // RFC 2606, 6303, 7393
     // https://www.iana.org/assignments/locally-served-dns-zones/locally-served-dns-zones.xhtml
@@ -270,7 +272,7 @@ public class DNSOverHTTPS implements EepGet.StatusListener {
             String furl = url + "name=" + host + "&type=" + tcode;
             log("Fetching " + furl);
             baos.reset();
-            SSLEepGet eepget = new SSLEepGet(ctx, baos, furl, state);
+            SSLEepGet eepget = new SSLEepGet(ctx, baos, furl, MAX_RESPONSE_SIZE, state);
             eepget.forceDNSOverHTTPS(false);
             eepget.addHeader("User-Agent", UA_CLEARNET);
             if (ctx.isRouterContext())
@@ -512,6 +514,7 @@ public class DNSOverHTTPS implements EepGet.StatusListener {
                 type = Type.V6_ONLY;
                 totest = v6urls;
             }
+            Collections.sort(totest);
             DNSOverHTTPS doh = new DNSOverHTTPS(I2PAppContext.getGlobalContext());
             System.out.println("Testing " + totest.size() + " servers");
             int pass = 0, fail = 0;
diff --git a/core/java/src/net/i2p/util/SSLEepGet.java b/core/java/src/net/i2p/util/SSLEepGet.java
index e841e6f66bd7cb8a63205e9e0678add8f9fac4e9..b5771b34950f39438247348f4dcdcc1645e09b42 100644
--- a/core/java/src/net/i2p/util/SSLEepGet.java
+++ b/core/java/src/net/i2p/util/SSLEepGet.java
@@ -126,7 +126,18 @@ public class SSLEepGet extends EepGet {
      *  @since 0.8.2
      */
     public SSLEepGet(I2PAppContext ctx, OutputStream outputStream, String url, SSLState state) {
-        this(ctx, null, outputStream, url, null);
+        this(ctx, null, outputStream, url, -1, state);
+    }
+
+    /**
+     *  @param maxSize The maximum size of the response
+     *  @param state an SSLState retrieved from a previous SSLEepGet with getSSLState(), or null.
+     *               This makes repeated fetches from the same host MUCH faster,
+     *               and prevents repeated key store loads even for different hosts.
+     *  @since 0.9.48
+     */
+    public SSLEepGet(I2PAppContext ctx, OutputStream outputStream, String url, long maxSize, SSLState state) {
+        this(ctx, null, outputStream, url, maxSize, state);
     }
 
     /**
@@ -144,7 +155,7 @@ public class SSLEepGet extends EepGet {
      *  @since 0.9.9
      */
     public SSLEepGet(I2PAppContext ctx, String outputFile, String url, SSLState state) {
-        this(ctx, outputFile, null, url, null);
+        this(ctx, outputFile, null, url, -1, state);
     }
 
     /**
@@ -239,10 +250,10 @@ public class SSLEepGet extends EepGet {
      *               and prevents repeated key store loads even for different hosts.
      *  @since 0.9.9
      */
-    private SSLEepGet(I2PAppContext ctx, String outputFile, OutputStream outputStream, String url, SSLState state) {
+    private SSLEepGet(I2PAppContext ctx, String outputFile, OutputStream outputStream, String url, long maxSize, SSLState state) {
         // we're using this constructor:
         // public EepGet(I2PAppContext ctx, boolean shouldProxy, String proxyHost, int proxyPort, int numRetries, long minSize, long maxSize, String outputFile, OutputStream outputStream, String url, boolean allowCaching, String etag, String postData) {
-        super(ctx, false, null, -1, 0, -1, -1, outputFile, outputStream, url, true, null, null);
+        super(ctx, false, null, -1, 0, -1, maxSize, outputFile, outputStream, url, true, null, null);
         _proxyType = ProxyType.NONE;
         if (state != null && state.context != null)
             _sslContext = state.context;