In embodiments of mesh network commissioning, a joiner router receives a DTLS-ClientHello message from a joining device requesting to join a mesh network, and the received message is encapsulated in a DTLS Relay Receive Notification message that is transmitted to a commissioning device of the mesh network. The joiner router receives a DTLS Relay Transmit Notification message from the commissioning device, and transmits content of the message to the joining device, where the content enables the joining device to join the mesh network. The joiner router receives an indication from the commissioning device that the joining device is to be entrusted to receive network credentials for the mesh network, and receives a Key Encryption Key (KEK) that is shared between the commissioning device and the joining device. The joiner router then transmits the network credentials to the joining device using the KEK to secure communication of the network credentials.