diff --git a/CHANGELOG.md b/CHANGELOG.md
index 918e1af..6231ece 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule forwarding udp dns requests (port 53) to tor
+  (alternative for less flexible `docker run --publish 53:9053 …`)
 
 ## [4.2.0] - 2021-04-30
 ### Added
diff --git a/entrypoint.sh b/entrypoint.sh
index c76ca00..928ac4e 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -4,7 +4,10 @@ set -e
 
 if [ "$(id -u)" -eq 0 ]; then
     nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
-        || echo 'failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+        || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \
+        || echo 'warning: failed to configure nftables for DNS proxy' \
+                '(alternative for less flexible `docker run --publish 53:9053 ...`)'
     exec su -s /bin/sh tor -- "$0" "$@"
 fi