Each <instance>.<BRIDGE_HOSTNAME> apex now answers SOA and the configured NS set, and nested names get NODATA with the apex SOA. The server listens on UDP and TCP at the same address, binding both synchronously and releasing both if either fails; a failure on either transport stops the process. UDP replies are truncated with TC to the client's EDNS0 size, or 512 bytes without EDNS0. Replies to EDNS queries carry an OPT advertising 1232 bytes on both transports. TCP is capped at 256 connections with 2s read and 3s idle timeouts, 16 queries per connection, and backoff on temporary accept errors. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>