diff --git a/setup/install.ps1 b/setup/install.ps1
index d89cac5..bbc03a6 100644
--- a/setup/install.ps1
+++ b/setup/install.ps1
@@ -72,8 +72,17 @@ if (Test-Path $s3d) {
 # 2) Route queries to it
 $state = @{ mode = $Mode; adapters = @() }
 if ($Mode -eq "nrpt") {
-  Add-DnsClientNrptRule -Namespace ".bch" -NameServers "127.0.0.1" -Comment "BNS .bch resolver"
-  Write-Host "[ok] NRPT rule added: .bch -> 127.0.0.1 (all other DNS untouched)"
+  # One NRPT rule per BNS-native TLD. These have no ICANN presence, so routing
+  # them to the local daemon carries no risk of hijacking real sites. Dual TLDs
+  # (.de, .ru, .dev, .ltd) are deliberately NOT here -- they need the daemon's
+  # DNS-forwarding path, which currently has an EDNS/AAAA bug that makes some
+  # strict clients reject the forwarded reply. Add those only after that fix.
+  $NATIVE_TLDS = @(".bch", ".p2p", ".bit", ".nav")
+  foreach ($tld in $NATIVE_TLDS) {
+    Add-DnsClientNrptRule -Namespace $tld -NameServers "127.0.0.1" -Comment "BNS $tld resolver"
+    Write-Host "[ok] NRPT rule added: $tld -> 127.0.0.1"
+  }
+  Write-Host "[ok] all other DNS untouched"
 } else {
   # Reinstall-safe backup: if the machine is ALREADY pointed at us (127.0.0.1) from a
   # prior install, the "current" servers are a useless restore target. Reuse the last