diff --git a/include/libwebsockets/lws-secure-streams.h b/include/libwebsockets/lws-secure-streams.h
index 93d279658..08bb68f50 100644
--- a/include/libwebsockets/lws-secure-streams.h
+++ b/include/libwebsockets/lws-secure-streams.h
@@ -187,7 +187,8 @@ typedef uint32_t lws_ss_tx_ordinal_t;
 typedef enum {
 	LWSSSCS_CREATING,
 	LWSSSCS_DISCONNECTED,
-	LWSSSCS_UNREACHABLE,
+	LWSSSCS_UNREACHABLE,		/* oridinal arg = 1 = caused by dns
+					 * server reachability failure */
 	LWSSSCS_AUTH_FAILED,
 	LWSSSCS_CONNECTED,
 	LWSSSCS_CONNECTING,
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index 313de3366..28737adc0 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -99,7 +99,9 @@ lws_ss_event_helper(lws_ss_handle_t *h, lws_ss_constate_t cs)
 #endif
 
 	if (h->info.state) {
-		r = h->info.state(ss_to_userobj(h), NULL, cs, 0);
+		r = h->info.state(ss_to_userobj(h), NULL, cs,
+			cs == LWSSSCS_UNREACHABLE &&
+			h->wsi && h->wsi->dns_reachability);
 #if defined(LWS_WITH_SERVER)
 		if ((h->info.flags & LWSSSINFLAGS_ACCEPTED) &&
 		    cs == LWSSSCS_DISCONNECTED)