more config

README.md

@@ -888,3 +888,37 @@ Found while writing this file; each is a to-do, not something fixed here.
     are advertised for exact origins too. Pinned by
     `TestCORSWildcardEchoesTheOrigin` and `TestCORSPreflight`; whether a
     wildcard should be refused outright is a decision.
+
+### Conditional forwarding
+
+To resolve DHCP names through a firewall, add suffix routes under `upstream`:
+
+```yaml
+upstream:
+  # Keep your existing default servers and policy here.
+  forward_zones:
+    - zone: local
+      servers:
+        - addr: 10.10.0.1:53
+          proto: udp
+```
+
+`local` matches both `local.` and every name below it, including
+`fastpi.local.`. Do not write `*.local`. Matching ignores case and chooses the
+most specific suffix. Forwarding targets are separate from default servers;
+matched queries never fall back to public DNS, even if all targets fail. UDP
+retries truncated replies over TCP. Local authoritative zones retain precedence,
+and ACL and blocklist policies still apply. The firewall must answer these names
+itself rather than forwarding them back to fancy-dns.
+
+Rules are configured in YAML, not in the console. Rebuild and deploy a binary
+with forwarding support before using this key: older versions ignore unknown
+keys. Send SIGHUP after editing YAML; upstream reloads flush the cache. The
+Kubernetes ConfigMap includes `local` forwarding to `10.10.0.1`. Roll out the new
+image/config together or reload the updated config in a compatible running pod.
+Test with `dig @<fancy-dns-address> fastpi.local A`.
+
+`.local` is reserved for multicast DNS, so some clients may send these names
+to mDNS instead of their configured DNS server. For new residential networks,
+use `home.arpa` (RFC 8375). Reverse DHCP lookups can use another route such as
+`11.10.10.in-addr.arpa` for the `10.10.11.0/24` subnet.