diff --git a/docs/08-DNS-ARCHITECTURE.md b/docs/08-DNS-ARCHITECTURE.md
index 5b1a1f7..fcba615 100644
--- a/docs/08-DNS-ARCHITECTURE.md
+++ b/docs/08-DNS-ARCHITECTURE.md
@@ -65,7 +65,7 @@ Dual AdGuard DNS setup with automatic failover. All DNS queries are filtered thr
 | Instance | Role | IP | Port | Web UI |
 |----------|------|-----|------|--------|
 | MikroTik | Primary | 172.17.0.2 | 53 | http://192.168.10.1:3000 |
-| Unraid | Secondary/Failover | 192.168.10.10 | 3000 | http://192.168.10.10:3000 |
+| Unraid | Secondary/Failover | 192.168.10.10 | 53 | http://192.168.10.10:3000 |
 
 ### Credentials (Same for Both)
 
@@ -147,9 +147,11 @@ Two independent Netwatch monitors trigger failover:
 
 ```routeros
 # dns-failover-down (runs when either check fails)
+# NOTE: to-ports MUST be 53 (Unraid AdGuard DNS port), NOT 3000 (web UI).
+# Fixed 2026-08-07 — previously 3000, which would have broken DNS during failover.
 /system script add name=dns-failover-down dont-require-permissions=yes source={
     :log warning "DNS Failover: Switching to Unraid"
-    /ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=192.168.10.10 to-ports=3000
+    /ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=192.168.10.10 to-ports=53
 }
 
 # dns-failover-up (runs when check recovers)