diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index 48d9b37..4e4cf2e 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -207,6 +207,8 @@ A `tls://` upstream's host must be an IP literal. nxdns does not resolve an upst
 
 A DoH upstream is not affected: `https://` goes through the HTTP client, which resolves normally, so a hostname there is the usual form.
 
+The DoH client speaks HTTP/1.1 only (HTTP/2 is out of scope), so a DoH server that requires HTTP/2 fails every exchange. Quad9 is one: `https://dns.quad9.net/dns-query` answers HTTP/1.1 with `505` (checked 2026-10-19). Reach Quad9 over DoT instead, as in the example above.
+
 ### clients
 
 Known clients with a fixed group assignment.
@@ -425,7 +427,7 @@ The smallest file that passes validation: a `default` group and one enabled upst
 ```zon
 .{
     .groups = .{ .{ .name = "default" } },
-    .upstreams = .{ .{ .url = "https://dns.quad9.net/dns-query" } },
+    .upstreams = .{ .{ .url = "https://cloudflare-dns.com/dns-query" } },
 }
 ```
 
@@ -483,7 +485,7 @@ The smallest file that passes validation: a `default` group and one enabled upst
     // tls_name is needed when a tls:// upstream is written as an IP
     // literal, so certificate verification has a DNS name to match.
     .upstreams = .{
-        .{ .url = "https://dns.quad9.net/dns-query", .priority = 10 },
+        .{ .url = "https://cloudflare-dns.com/dns-query", .priority = 10 },
         .{ .url = "tls://9.9.9.9:853", .priority = 20, .tls_name = "dns.quad9.net" },
     },