diff --git a/CHANGES b/CHANGES
index 5b1a765b3e..0e87b1113c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4734.	[contrib]	Added sample configuration for DNS-over-TLS in
+			contrib/dnspriv.
+
 4733.	[bug]		Change #4706 introduced a bug causing TCP clients
 			not be reused correctly, leading to unconstrained
 			memory growth. [RT #46029]
diff --git a/contrib/README b/contrib/README
index 598e914251..6762169251 100644
--- a/contrib/README
+++ b/contrib/README
@@ -21,6 +21,11 @@ but reported bugs will be fixed as time permits.
       mkdane.sh generates TLSA records for use with DNS-based
       Authentication of Named Entities (DANE)
 
+    - dnspriv/
+
+      Sample configuration for setting up a DNS-over-TLS server
+      using BIND with Nginx as a TLS proxy
+
     - dlz/modules
 
       Dynamically linkable DLZ modules that can be configured into
diff --git a/contrib/dnspriv/README.md b/contrib/dnspriv/README.md
new file mode 100644
index 0000000000..8297cb118a
--- /dev/null
+++ b/contrib/dnspriv/README.md
@@ -0,0 +1,20 @@
+<!--
+ - Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+### DNS Privacy in BIND
+
+This directory contains sample configuration files to enable BIND,
+with Nginx as a TLS proxy, to provide DNS over TLS.
+
+`named.conf` configures a validating recursive name server to listen
+on the localhost address at port 8853.
+
+`nginx.conf` configures a TLS proxy to listen on port 853 and
+forward queries and responses to `named`.
+
+For more information, please see
+[https://dnsprivacy.org/wiki/](https://dnsprivacy.org/wiki/)
diff --git a/contrib/dnspriv/named.conf b/contrib/dnspriv/named.conf
new file mode 100644
index 0000000000..03fb612433
--- /dev/null
+++ b/contrib/dnspriv/named.conf
@@ -0,0 +1,15 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+options {
+	listen-on port 8853 { 127.0.0.1; };
+	allow-query { localhost; };
+	recursion yes;
+	dnssec-validation auto;
+	tcp-clients 1024;
+};
diff --git a/contrib/dnspriv/nginx.conf b/contrib/dnspriv/nginx.conf
new file mode 100644
index 0000000000..b11749da8c
--- /dev/null
+++ b/contrib/dnspriv/nginx.conf
@@ -0,0 +1,38 @@
+# Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# uncomment to choose an appropriate UID/GID; default is 'nobody'
+# user bind bind;
+
+worker_processes auto;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+    multi_accept on;
+}
+
+stream {
+    upstream dns_tcp_servers {
+	server 127.0.0.1:8853;
+    }
+
+    server {
+	listen 853 ssl;
+	proxy_pass dns_tcp_servers;
+
+	# update to a suitable SSL certificate (e.g. from LetsEncrypt),
+	# and uncomment the following lines:
+	# ssl_certificate       /etc/nginx/lego/certificates/<cert>.crt;
+	# ssl_certificate_key   /etc/nginx/lego/certificates/<cert>.key;
+
+	ssl_protocols         TLSv1.2;
+	ssl_ciphers           ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+	ssl_session_tickets   on;
+	ssl_session_timeout   4h;
+	ssl_handshake_timeout 30s;
+    }
+}
diff --git a/util/copyrights b/util/copyrights
index aa3c6c1db2..c9f25932ad 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -2621,7 +2621,7 @@
 ./conftools/perllib/dnsconf/Makefile.PL		PERL	2000,2001,2004,2007,2012,2016
 ./conftools/perllib/dnsconf/named1.conf		CONF-C	2000,2001,2004,2007,2016
 ./conftools/perllib/dnsconf/test.pl		PERL	2000,2001,2004,2007,2012,2016
-./contrib/README				X	2014,2015,2016
+./contrib/README				X	2014,2015,2016,2017
 ./contrib/dane/mkdane.sh			X	2012
 ./contrib/dane/tlsa6698.pem			X	2012
 ./contrib/dlz/.gitignore			X	2014
@@ -2751,6 +2751,9 @@
 ./contrib/dnsperf-2.1.0.0-1/util.h		X	2016
 ./contrib/dnsperf-2.1.0.0-1/version.h		X	2016
 ./contrib/dnsperf-patches/0001-Add-support-for-sending-EDNS-CLIENT-SUBNET-option-in.patch	X	2016
+./contrib/dnspriv/README.md			MKD	2017
+./contrib/dnspriv/named.conf			CONF-C	2017
+./contrib/dnspriv/nginx.conf			SH	2017
 ./contrib/idn/README.idnkit			X	2005,2009
 ./contrib/idn/idnkit-1.0-src/.gitignore		X	2014
 ./contrib/idn/idnkit-1.0-src/ChangeLog		X	2003