diff --git a/script/infra-setup.sh b/script/infra-setup.sh
index 17947c4..4f322ec 100755
--- a/script/infra-setup.sh
+++ b/script/infra-setup.sh
@@ -263,11 +263,27 @@ mint_internal_cert() {
     run_remote "$host" "systemctl enable --now step@${CERT_NAME}.timer"
 }
 
+# DNS is not managed by this script, but the deployment doesn't work without two records.
+# Print them explicitly — a missing or wrong split-horizon record is the classic reason a
+# mesh client gets the wrong site/cert (reverse-proxies.md §2, external-tls.md §5).
+dns_reminders() {
+    local web_ip; web_ip="$(getent hosts "$WEB_HOST" | awk '{print $1}' | head -1)"
+    web_ip="${web_ip:-<oolon mesh IP>}"
+    info "DNS (manage separately — not done by this script):"
+    info "  • add split-horizon  ${CERT_NAME}.internal -> ${web_ip}  (mesh access path)"
+    if [[ -n "$PUBLIC_FQDN" ]]; then
+        info "  • ${PUBLIC_FQDN}: public A -> kosherinata WAN only. Do NOT add an internal"
+        info "    override for it — an internal record pointing elsewhere (e.g. the office"
+        info "    proxy) makes mesh clients hit the wrong vhost. Mesh users use ${CERT_NAME}.internal."
+    fi
+}
+
 main() {
     require_files
     info "newsfeed infra-setup (api=$API_HOST web=$WEB_HOST)$([[ $DRY_RUN == 1 ]] && echo ' [dry-run]')"
     provision_api_host
     provision_web_host
+    dns_reminders
     info "done"
 }