diff --git a/internal/api/v1/helpers.go b/internal/api/v1/helpers.go
index 274e060..cc3d686 100644
--- a/internal/api/v1/helpers.go
+++ b/internal/api/v1/helpers.go
@@ -101,8 +101,9 @@ func (api *API) reconcileNetworking() {
 	}
 
 	// Generate dnsmasq DNS entries from registered services.
-	// All service domains resolve to Central's IP (where HAProxy listens).
-	// HAProxy then routes to the actual backend based on SNI or Host header.
+	// DNS target IP depends on service type:
+	//   tcp-passthrough (k8s): DNS → k8s LB IP (LAN traffic goes direct to k8s)
+	//   http/static: DNS → Central IP (HAProxy terminates TLS)
 	centralIP, _ := network.GetWildCentralIP()
 	if centralIP == "" {
 		centralIP = "127.0.0.1"
@@ -113,9 +114,27 @@ func (api *API) reconcileNetworking() {
 		if svc.Reach == services.ReachOff || svc.Domain == "" {
 			continue
 		}
+
+		// Choose the DNS target IP based on service type
+		dnsIP := centralIP
+		if svc.Backend.Type == services.BackendTCPPassthrough {
+			// k8s instances: LAN clients connect directly to the k8s LB
+			dnsIP = extractHost(svc.Backend.Address)
+		}
+
+		// Primary domain
 		ic := config.InstanceConfig{}
 		ic.Cloud.Domain = svc.Domain
-		ic.Cluster.LoadBalancerIp = centralIP // DNS points to Central, not the backend
+		ic.Cluster.LoadBalancerIp = dnsIP
+
+		// Extra domains (e.g., internal.cloud.payne.io)
+		for _, extra := range svc.ExtraDomains {
+			if strings.HasPrefix(extra, "internal.") {
+				// Internal-only domain: local=/ prevents upstream DNS forwarding
+				ic.Cloud.InternalDomain = extra
+			}
+		}
+
 		instanceConfigs = append(instanceConfigs, ic)
 	}