diff --git a/src/cli/cli.go b/src/cli/cli.go
index ca0b7bb3..846905a5 100644
--- a/src/cli/cli.go
+++ b/src/cli/cli.go
@@ -50,7 +50,7 @@ type GeneralOptions struct {
 	NameServerMode       bool   `long:"name-server-mode" description:"Treats input as nameservers to query with a static query rather than queries to send to a static name server"`
 	NameServersString    string `long:"name-servers" description:"List of DNS servers to use. Can be passed as comma-delimited string or via @/path/to/file. If no port is specified, defaults to 53."`
 	UseNanoseconds       bool   `long:"nanoseconds" description:"Use nanosecond resolution timestamps in output"`
-	NetworkTimeout       int    `long:"network-timeout" default:"3" description:"timeout for network operations, in seconds"`
+	NetworkTimeout       int    `long:"network-timeout" default:"2" description:"timeout for network operations, in seconds"`
 	DisableFollowCNAMEs  bool   `long:"no-follow-cnames" description:"do not follow CNAMEs/DNAMEs in the lookup process"`
 	Retries              int    `long:"retries" default:"1" description:"how many times should zdns retry query against a new nameserver if timeout or temporary failure"`
 	Threads              int    `short:"t" long:"threads" default:"100" description:"number of lightweight go threads"`
diff --git a/src/zdns/resolver.go b/src/zdns/resolver.go
index 60f61c95..09065b74 100644
--- a/src/zdns/resolver.go
+++ b/src/zdns/resolver.go
@@ -37,6 +37,7 @@ import (
 const (
 	defaultTimeout               = 15 * time.Second // timeout for resolving a single name
 	defaultIterativeTimeout      = 4 * time.Second  // timeout for single iteration in an iterative query
+	defaultNetworkTimeout        = 2 * time.Second  // timeout for a single on-the-wire network call
 	defaultTransportMode         = UDPOrTCP
 	defaultShouldRecycleSockets  = true
 	defaultLogVerbosity          = 3 // 1 = lowest, 5 = highest
@@ -236,6 +237,7 @@ func NewResolverConfig() *ResolverConfig {
 
 		Timeout:          defaultTimeout,
 		IterativeTimeout: defaultIterativeTimeout,
+		NetworkTimeout:   defaultNetworkTimeout,
 		MaxDepth:         defaultMaxDepth,
 
 		DNSSecEnabled:       defaultDNSSECEnabled,