diff --git a/deps/cares/src/ares_create_query.c b/deps/cares/src/ares_create_query.c
index 1606b1a1004706..9efce17cfa32aa 100644
--- a/deps/cares/src/ares_create_query.c
+++ b/deps/cares/src/ares_create_query.c
@@ -94,14 +94,14 @@ int ares_create_query(const char *name, int dnsclass, int type,
   size_t buflen;
   unsigned char *buf;
 
-  /* Per RFC 7686, reject queries for ".onion" domain names with NXDOMAIN. */
-  if (ares__is_onion_domain(name))
-    return ARES_ENOTFOUND;
-
   /* Set our results early, in case we bail out early with an error. */
   *buflenp = 0;
   *bufp = NULL;
 
+  /* Per RFC 7686, reject queries for ".onion" domain names with NXDOMAIN. */
+  if (ares__is_onion_domain(name))
+    return ARES_ENOTFOUND;
+
   /* Allocate a memory area for the maximum size this packet might need. +2
    * is for the length byte and zero termination if no dots or ecscaping is
    * used.
diff --git a/test/parallel/test-dns.js b/test/parallel/test-dns.js
index 200b5d3cb4758e..b96055ba4dceab 100644
--- a/test/parallel/test-dns.js
+++ b/test/parallel/test-dns.js
@@ -314,3 +314,13 @@ common.expectsError(() => {
   code: 'ERR_INVALID_CALLBACK',
   type: TypeError
 });
+
+{
+  dns.resolveMx('foo.onion', function(err) {
+    assert.deepStrictEqual(err.errno, 'ENOTFOUND');
+    assert.deepStrictEqual(err.code, 'ENOTFOUND');
+    assert.deepStrictEqual(err.syscall, 'queryMx');
+    assert.deepStrictEqual(err.hostname, 'foo.onion');
+    assert.deepStrictEqual(err.message, 'queryMx ENOTFOUND foo.onion');
+  });
+}