diff --git a/PopuraDNS b/PopuraDNS
index c7c07e0..09c25f5 160000
--- a/PopuraDNS
+++ b/PopuraDNS
@@ -1 +1 @@
-Subproject commit c7c07e0e4b0e566ccb69b7456f27e873a261a787
+Subproject commit 09c25f514e073d55097de068e30ba52f7880a80a
diff --git a/README.md b/README.md
index d4f5d31..2c13068 100644
--- a/README.md
+++ b/README.md
@@ -99,16 +99,27 @@ The stack now provides DNS resolution for a comprehensive set of alternative TLD
 | `.i2p` | i2pd DNS (10.5.0.2:53) | I2P eepsite names |
 | `.eth` | ensdns (10.5.0.11) via CoreDNS | Ethereum Name Service (local resolver) |
 | `.bit` | namecoindns (10.5.0.12) via CoreDNS | Namecoin names (local resolver service) |
-| `.alt` | alt-root 185.121.177.177 | Alternative DNS root |
+| `.alt` | local unbound (10.5.0.5) via CoreDNS | Alternative DNS root (local-only fallback mode) |
 | `.loki` | local lokinet (10.5.0.14) via CoreDNS | Lokinet privacy network |
-| `.zil` | Cloudflare 1.1.1.1 | Zilliqa blockchain |
-| `.web3` | Cloudflare 1.1.1.1 | General blockchain namespace |
+| `.zil` | local unbound (10.5.0.5) via CoreDNS | Zilliqa blockchain (local-only fallback mode) |
+| `.web3` | local unbound (10.5.0.5) via CoreDNS | General blockchain namespace (local-only fallback mode) |
 | Alfis TLDs | Alfis (10.5.0.3) | `.anon`, `.btn`, `.conf`, `.index`, `.merch`, `.mirror`, `.mob`, `.screen`, `.srv`, `.ygg` |
 | EmerCoin TLDs | EmerCoin (10.5.0.9) | `.emc`, `.coin`, `.lib`, `.bazar`, `.enum` |
-| OpenNIC TLDs | OpenNIC public resolvers | `.bbs`, `.chan`, `.cyb`, `.dyn`, `.epic`, `.geek`, `.gopher`, `.indy`, `.libre`, `.neo`, `.null`, `.o`, `.oss`, `.oz`, `.parody`, `.pirate`, `.fur`, `.ku`, `.rm`, `.te`, `.ti`, `.uu`, `.ko` |
+| OpenNIC TLDs | local unbound (10.5.0.5) via CoreDNS | `.bbs`, `.chan`, `.cyb`, `.dyn`, `.epic`, `.geek`, `.gopher`, `.indy`, `.libre`, `.neo`, `.null`, `.o`, `.oss`, `.oz`, `.parody`, `.pirate`, `.fur`, `.ku`, `.rm`, `.te`, `.ti`, `.uu`, `.ko` (local-only fallback mode) |
 | Clearnet | Unbound (10.5.0.5) | All other domains via recursive resolution |
 
 
+## Local-only DNS mode limitations
+
+Darkproxy now avoids direct public DNS forwarders for `.alt`, `.zil`, `.web3`, OpenNIC TLDs, and Lokinet fallback DNS.
+
+Important limitations still apply for authoritative data:
+
+* `.eth` requires an Ethereum JSON-RPC backend. By default this stack uses `https://ethereum-rpc.publicnode.com` in `ensdns`.
+* `.alt`, OpenNIC TLDs, `.zil`, and `.web3` are not in the ICANN root. In local-only fallback mode they are sent to local Unbound, so they usually return `NXDOMAIN` unless you provide your own authoritative/local resolver backend for those namespaces.
+* `.loki` is resolved by local Lokinet, and Lokinet fallback DNS now points to local Unbound instead of a public resolver.
+
+
 ## Configuration validation and drift tests
 
 A simple automation is included to help detect accidental changes to the
diff --git a/lokinet/lokinet.ini b/lokinet/lokinet.ini
index f382d35..29a1043 100644
--- a/lokinet/lokinet.ini
+++ b/lokinet/lokinet.ini
@@ -8,7 +8,7 @@ ifname=lokinet0
 
 [dns]
 bind=0.0.0.0:53
-upstream=1.1.1.1:53
+upstream=10.5.0.5:53
 no-resolvconf=1
 
 [bootstrap]