diff --git a/go.mod b/go.mod
index db043331d..03074937f 100644
--- a/go.mod
+++ b/go.mod
@@ -42,6 +42,7 @@ require (
 	github.com/klauspost/compress v1.18.0
 	github.com/martinlindhe/base36 v1.1.1
 	github.com/mholt/acmez/v3 v3.1.1
+	github.com/miekg/dns v1.1.63
 	github.com/minio/minio-go/v7 v7.0.89
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
@@ -185,7 +186,6 @@ require (
 	github.com/magiconair/properties v1.8.9 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/miekg/dns v1.1.63 // indirect
 	github.com/minio/crc64nvme v1.0.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
diff --git a/pkg/storage/postgres/backend_test.go b/pkg/storage/postgres/backend_test.go
index 1677bd33c..ae80377b2 100644
--- a/pkg/storage/postgres/backend_test.go
+++ b/pkg/storage/postgres/backend_test.go
@@ -3,13 +3,16 @@ package postgres
 import (
 	"context"
 	"fmt"
+	"net"
 	"os"
 	"runtime"
 	"testing"
 	"time"
 
+	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/test/bufconn"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -201,7 +204,9 @@ func TestBackend(t *testing.T) {
 }
 
 func TestLookup(t *testing.T) {
-	t.Parallel()
+	originalDefaultResolver := net.DefaultResolver
+	net.DefaultResolver = stubResolver(t)
+	t.Cleanup(func() { net.DefaultResolver = originalDefaultResolver })
 
 	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
 	t.Cleanup(clearTimeout)
@@ -209,7 +214,30 @@ func TestLookup(t *testing.T) {
 	cfg, err := ParseConfig("host=localhost")
 	assert.NoError(t, err)
 
-	addrs, err := cfg.ConnConfig.LookupFunc(ctx, "test.unknown")
+	addrs, err := cfg.ConnConfig.LookupFunc(ctx, "www.example.com")
 	assert.NoError(t, err)
 	assert.Empty(t, addrs)
 }
+
+// stubResolver returns a fake DNS resolver that always responds with NXDOMAIN.
+func stubResolver(t *testing.T) *net.Resolver {
+	stubListener := bufconn.Listen(1500)
+	stubDNS := &dns.Server{
+		Listener: stubListener,
+		Handler: dns.HandlerFunc(func(w dns.ResponseWriter, r *dns.Msg) {
+			m := &dns.Msg{}
+			m.SetRcode(r, dns.RcodeNameError)
+			w.WriteMsg(m)
+		}),
+	}
+
+	go stubDNS.ActivateAndServe()
+	t.Cleanup(func() { stubDNS.Shutdown() })
+
+	return &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, _, _ string) (net.Conn, error) {
+			return stubListener.DialContext(ctx)
+		},
+	}
+}