diff --git a/cmd/remoteva/main.go b/cmd/remoteva/main.go
index e398f1b82..1e9f15fd7 100644
--- a/cmd/remoteva/main.go
+++ b/cmd/remoteva/main.go
@@ -59,7 +59,8 @@ type Config struct {
 		// For more information, see: https://pkg.go.dev/crypto/tls#ClientAuthType
 		SkipGRPCClientCertVerification bool
 
-		Features features.Config
+		Features     features.Config
+		LabCADomains []string
 	}
 
 	Syslog        cmd.SyslogConfig
@@ -89,12 +90,16 @@ func main() {
 	clk := clock.New()
 
 	var servers bdns.ServerProvider
+	proto := "udp"
+	if features.Get().DOH {
+		proto = "tcp"
+	}
 
 	if len(c.RVA.DNSStaticResolvers) != 0 {
 		servers, err = bdns.NewStaticProvider(c.RVA.DNSStaticResolvers)
 		cmd.FailOnError(err, "Couldn't start static DNS server resolver")
 	} else {
-		servers, err = bdns.StartDynamicProvider(c.RVA.DNSProvider, 60*time.Second, "tcp")
+		servers, err = bdns.StartDynamicProvider(c.RVA.DNSProvider, 60*time.Second, proto)
 		cmd.FailOnError(err, "Couldn't start dynamic DNS server resolver")
 	}
 	defer servers.Stop()
@@ -128,6 +133,7 @@ func main() {
 		c.RVA.Perspective,
 		c.RVA.RIR,
 		iana.IsReservedAddr,
+		c.RVA.LabCADomains,
 		0,
 		c.RVA.DNSAllowLoopbackAddresses,
 	)