diff --git a/lib/configuration.js b/lib/configuration.js
index 736fdb22c..637744b49 100644
--- a/lib/configuration.js
+++ b/lib/configuration.js
@@ -225,8 +225,9 @@ var conf = module.exports = convict({
   process_type: 'string',
   email_to_console: 'boolean = false',
   declaration_of_support_timeout_ms: {
-    doc: "The amount of time we wait for a server to respond with a declaration of support, before concluding that they are not a primary.  Only relevant when our local proxy is in use, not in production or staging",
-    format: 'integer = 15000'
+    doc: "The amount of time we wait for a server to respond with a declaration of support, before concluding that they are not a primary. Needs to be shorter than the dialog's time_until_delay param to avoid xhr-delay UI.",
+    format: 'integer = 8000',
+    env: 'DECLARATION_OF_SUPPORT_TIMEOUT_MS'
   },
   enable_development_menu: {
     doc: "Whether or not the development menu can be accessed",
diff --git a/lib/primary.js b/lib/primary.js
index e98430564..fe4d1dca6 100644
--- a/lib/primary.js
+++ b/lib/primary.js
@@ -13,6 +13,7 @@ logger = require('./logging.js').logger,
 urlparse = require('urlparse'),
 jwcrypto = require("jwcrypto"),
 config = require("./configuration.js"),
+primaryTimeout = config.get('declaration_of_support_timeout_ms'), 
 secrets = require("./secrets.js");
 
 // alg
@@ -201,7 +202,16 @@ var getWellKnown = function (domain, delegates, cb) {
     }, handleResponse);
   }
 
+  // front-end shows xhr delay message after 10 sec; timeout sooner to avoid this
+  var reqTimeout = setTimeout(function() {
+    req.abort();
+    logger.debug('timeout trying to load well-known for ' + domain + ': ' + e.toString());
+    handleProxyIDP();
+  }, primaryTimeout);
+  req.on('response', function() { clearTimeout(reqTimeout) });
+
   req.on('error', function(e) {
+    if (reqTimeout) { clearTimeout(reqTimeout); }
     logger.debug(domain + ' is not a browserid primary: ' + e.toString());
     handleProxyIDP();
   });