diff --git a/start.sh b/start.sh
index ef423a4..75c2a96 100755
--- a/start.sh
+++ b/start.sh
@@ -19,7 +19,19 @@ TS_IP="$(tailscale ip -4 2>/dev/null | head -1 || true)"
 # external fallback. Without this the container only has 8.8.8.8 and every
 # *.sami health-check probe fails with ENOTFOUND (uptime bars stay empty).
 DNS_PRIMARY="100.121.150.22"   # Technitium (Tailscale IP) — resolves *.sami
-DNS_FALLBACK="8.8.8.8"
+# DC-121: the fallback must ALSO serve *.sami. Node's tls.connect resolves via
+# dns.lookup → getaddrinfo → musl, which queries ALL resolv.conf nameservers in
+# PARALLEL and takes the first reply. With 8.8.8.8 as fallback, Google NXDOMAINs
+# the internal .sami TLD and wins that race ~2-5% of the time. Measured on DNS2
+# inside the live container 2026-08-24: dns.lookup 18/400 ENOTFOUND for records
+# that resolve fine via the primary; c-ares pinned to 8.8.8.8 alone returns
+# NXDOMAIN 10/10; c-ares pinned to the primary 0/400. (Source of ssl-monitor
+# "Failed to check cert" warn noise; the git.sami /etc/hosts pin below was a
+# per-name paperover of this same class.) DNS1's Technitium secondary
+# (100.71.97.12) serves *.sami AND recurses for external names — both verified
+# from inside the container — so whichever resolver wins the race, the answer
+# is correct.
+DNS_FALLBACK="100.71.97.12"    # DNS1 Technitium secondary — serves *.sami + recurses
 
 # --- One-time migration from Docker image layer to bind mount --------------
 # DC-039 follow-up. Before v1.14.10, certain modules (audit-logger, license-