diff --git a/Changelog.md b/Changelog.md
index 7affa855..6782c128 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -31,6 +31,8 @@ Changelog [format](http://keepachangelog.com/en/1.0.0/)
 * Handle double charset better by using local ParseMediaType instead of mime.ParseMediaType
 * Don't remove log dir
 * GODT-422 Fix element not found (avoid listing credentials, prefer getting)
+* GODT-404 Don't keep connections to proxy servers alive if user disables DoH
+* Ensure DoH is used at startup to load users for the initial auth
 
 ## [v1.2.7] Donghai-hotfix - beta (2020-05-07)
 
diff --git a/internal/bridge/bridge.go b/internal/bridge/bridge.go
index 95199585..0e2932af 100644
--- a/internal/bridge/bridge.go
+++ b/internal/bridge/bridge.go
@@ -53,6 +53,12 @@ func New(
 	clientManager users.ClientManager,
 	credStorer users.CredentialsStorer,
 ) *Bridge {
+	// Allow DoH before starting the app if the user has previously set this setting.
+	// This allows us to start even if protonmail is blocked.
+	if pref.GetBool(preferences.AllowProxyKey) {
+		clientManager.AllowProxy()
+	}
+
 	storeFactory := newStoreFactory(config, panicHandler, clientManager, eventListener)
 	u := users.New(config, panicHandler, eventListener, clientManager, credStorer, storeFactory)
 	b := &Bridge{
@@ -62,12 +68,6 @@ func New(
 		clientManager: clientManager,
 	}
 
-	// Allow DoH before starting the app if the user has previously set this setting.
-	// This allows us to start even if protonmail is blocked.
-	if pref.GetBool(preferences.AllowProxyKey) {
-		b.AllowProxy()
-	}
-
 	if pref.GetBool(preferences.FirstStartKey) {
 		b.SendMetric(metrics.New(metrics.Setup, metrics.FirstStart, metrics.Label(config.GetVersion())))
 	}
diff --git a/pkg/pmapi/client.go b/pkg/pmapi/client.go
index b8b1c45a..6af2b530 100644
--- a/pkg/pmapi/client.go
+++ b/pkg/pmapi/client.go
@@ -198,6 +198,10 @@ func (c *client) clearKeys() {
 	}
 }
 
+func (c *client) CloseConnections() {
+	c.hc.CloseIdleConnections()
+}
+
 // Do makes an API request. It does not check for HTTP status code errors.
 func (c *client) Do(req *http.Request, retryUnauthorized bool) (res *http.Response, err error) {
 	// Copy the request body in case we need to retry it.
diff --git a/pkg/pmapi/client_types.go b/pkg/pmapi/client_types.go
index 19ba0ac7..538d82cb 100644
--- a/pkg/pmapi/client_types.go
+++ b/pkg/pmapi/client_types.go
@@ -33,6 +33,7 @@ type Client interface {
 	Logout()
 	DeleteAuth() error
 	IsConnected() bool
+	CloseConnections()
 	ClearData()
 
 	CurrentUser() (*User, error)
diff --git a/pkg/pmapi/clientmanager.go b/pkg/pmapi/clientmanager.go
index 590d49e5..6159f4f8 100644
--- a/pkg/pmapi/clientmanager.go
+++ b/pkg/pmapi/clientmanager.go
@@ -230,6 +230,10 @@ func (cm *ClientManager) DisallowProxy() {
 
 	cm.allowProxy = false
 	cm.host = rootURL
+
+	for _, client := range cm.clients {
+		client.CloseConnections()
+	}
 }
 
 // IsProxyEnabled returns whether we are currently proxying requests.
diff --git a/pkg/pmapi/mocks/mocks.go b/pkg/pmapi/mocks/mocks.go
index 4deb0842..11399d72 100644
--- a/pkg/pmapi/mocks/mocks.go
+++ b/pkg/pmapi/mocks/mocks.go
@@ -137,6 +137,18 @@ func (mr *MockClientMockRecorder) ClearData() *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClearData", reflect.TypeOf((*MockClient)(nil).ClearData))
 }
 
+// CloseConnections mocks base method
+func (m *MockClient) CloseConnections() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CloseConnections")
+}
+
+// CloseConnections indicates an expected call of CloseConnections
+func (mr *MockClientMockRecorder) CloseConnections() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CloseConnections", reflect.TypeOf((*MockClient)(nil).CloseConnections))
+}
+
 // CountMessages mocks base method
 func (m *MockClient) CountMessages(arg0 string) ([]*pmapi.MessagesCount, error) {
 	m.ctrl.T.Helper()
diff --git a/test/fakeapi/fakeapi.go b/test/fakeapi/fakeapi.go
index 7031091c..74c6a77e 100644
--- a/test/fakeapi/fakeapi.go
+++ b/test/fakeapi/fakeapi.go
@@ -66,6 +66,10 @@ func New(controller *Controller, userID string) *FakePMAPI {
 	return fakePMAPI
 }
 
+func (api *FakePMAPI) CloseConnections() {
+	// NOOP
+}
+
 func (api *FakePMAPI) checkAndRecordCall(method method, path string, request interface{}) error {
 	if err := api.checkInternetAndRecordCall(method, path, request); err != nil {
 		return err