diff --git a/README.md b/README.md
index 6183503..0a45474 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,9 @@
 # secure-dns-proxy
 
-Proxied secure dns over an unencrypted DNS query to localhost (127.0.0.35:53)
+A lightweight proxy that handles secure DNS (DoH/DoT/DoQ) upstream while exposing a standard unencrypted DNS interface on `127.0.0.35:53`.
+
+Since the proxy listens only on a local address, unencrypted DNS is not a concern. All outbound DNS queries are securely forwarded using HTTPS, TLS, or QUIC.
+
+### Example Flow
+
+[https://doh.archuser.org/dns-query](https://doh.archuser.org/dns-query) *(encrypted: HTTPS protocol)* → **secure-dns-proxy** *(unencrypted: standard DNS protocol)* → `127.0.0.35:53`