diff --git a/README.md b/README.md
index 42d7203..30e7a79 100644
--- a/README.md
+++ b/README.md
@@ -17,10 +17,12 @@ Built so far:
 - Authentik OIDC login, roles (first user to sign in becomes admin), audit log
 - **Secrets** — expiry tracking for API tokens/certs/passwords
 - **IP Addresses (IPAM)** — inventory of IPs across vendors/locations
+- **DNS** — zone/record management across Cloudflare, Loopia, Pi-hole, Azure
+  DNS, cPanel, and Technitium; providers are configured in-app (not via env
+  vars) and their credentials are encrypted at rest
 
 Not yet built (see `.claude/plans` for the full delivery plan):
 
-- DNS management (Cloudflare/Loopia/Pi-hole/Azure/cPanel/Technitium)
 - Servers & scheduled task tracking (cron/systemd via agent)
 - Live integrations: Proxmox, Synology, Semaphore, Tailscale, Gitea, Dockhand