docs: clarify local DNS resolution model

README.md

@@ -43,6 +43,12 @@ This container runs the following vontainers in the stack.
 The system offers a DNS that resolves many darknet and clearnet IP's.  The
 stack now handles:
 
+Local resolution model (important):
+
+* DNS queries are resolved inside this Docker stack on your host (`pihole -> CoreDNS -> local resolver services`).
+* The stack does not forward DNS queries to public DNS providers for supported darknet/blockchain TLDs.
+* Some namespaces still require blockchain RPC data sources for authoritative records (see limitations below).
+
 * `*.onion` – forwarded to Tor's DNSPort running in the `darktor` container at
   10.5.0.7:9053.
 * `*.i2p`   – served by the built-in DNS server inside the `darki2p` container
@@ -113,6 +119,10 @@ The stack now provides DNS resolution for a comprehensive set of alternative TLD
 
 Darkproxy now avoids direct public DNS forwarders for `.alt`, `.zil`, `.web3`, OpenNIC TLDs, and Lokinet fallback DNS.
 
+Resolution still happens locally in this stack. The remaining external dependency
+surface is blockchain RPC/data access for record lookup, not public DNS
+forwarding.
+
 Important limitations still apply for authoritative data:
 
 * `.eth` requires an Ethereum JSON-RPC backend. By default this stack uses `https://ethereum-rpc.publicnode.com` in `ensdns`.