diff --git a/plugin/forward/setup.go b/plugin/forward/setup.go
index b661b300e..efba8c7bb 100644
--- a/plugin/forward/setup.go
+++ b/plugin/forward/setup.go
@@ -244,6 +244,7 @@ func parseStanza(c *caddy.Controller) (*Forward, error) {
 				Timeout:   2 * time.Second,
 			}
 			f.proxies[i].SetHTTPClient(&c)
+			f.proxies[i].SetTLSConfig(f.tlsConfig)
 			f.proxies[i].SetDOHRequestOptions(f.dohMethod)
 		}
 
diff --git a/plugin/forward/setup_test.go b/plugin/forward/setup_test.go
index b0b9d0f87..c31357d68 100644
--- a/plugin/forward/setup_test.go
+++ b/plugin/forward/setup_test.go
@@ -906,3 +906,30 @@ func TestSetupReadTimeout(t *testing.T) {
 		})
 	}
 }
+
+func TestSetupDOHHealthcheckTLSConfig(t *testing.T) {
+	c := caddy.NewTestController(
+		"dns",
+		`forward . https://127.0.0.1 {
+			tls_servername dns.example
+		}`,
+	)
+
+	fs, err := parseForward(c)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got := fs[0].
+		proxies[0].
+		GetHealthchecker().
+		GetTLSConfig()
+
+	if got.ServerName != "dns.example" {
+		t.Fatalf(
+			"Expected DoH healthcheck TLS server name %q, got %q",
+			"dns.example",
+			got.ServerName,
+		)
+	}
+}