diff --git a/DEVELOP.md b/DEVELOP.md
index 86f1860..d4dc008 100644
--- a/DEVELOP.md
+++ b/DEVELOP.md
@@ -87,10 +87,11 @@ See [docs/plan.md](docs/plan.md) for the full project plan and milestone checkli
 |-----------|--------|
 | M1 — Core Forwarding | ✅ Done |
 | M2 — Multiple Upstreams & Config | ✅ Done |
-| M3 — Caching | 🔲 Not started |
-| M4 — Observability | 🔲 Not started |
-| M5 — Blocking & Filtering | 🔲 Not started |
-| M6 — Production Hardening | 🔲 Not started |
+| M3 — Local DNS Listener | 🔲 Not started |
+| M4 — Caching | 🔲 Not started |
+| M5 — Observability | 🔲 Not started |
+| M6 — Blocking & Filtering | 🔲 Not started |
+| M7 — Production Hardening | 🔲 Not started |
 
 ## Useful Commands
 
diff --git a/docs/plan.md b/docs/plan.md
index 4ad8bad..fdd5b39 100644
--- a/docs/plan.md
+++ b/docs/plan.md
@@ -22,6 +22,10 @@ A lightweight DNS-over-HTTPS (DoH) forwarder that accepts DNS queries over HTTPS
 │  (browser,   │ HTTPS│  (this project)  │ HTTPS│  (1.1.1.1,      │
 │   OS, app)   │◀─────│                  │◀─────│   8.8.8.8, …)   │
 └─────────────┘      └──────────────────┘      └─────────────────┘
+       │                     ▲
+       │ UDP/TCP :53         │
+       └─────────────────────┘
+       System DNS (resolv.conf)
 ```
 
 ## Tech Stack
@@ -52,7 +56,17 @@ A lightweight DNS-over-HTTPS (DoH) forwarder that accepts DNS queries over HTTPS
 - [x] Environment variable overrides
 - [x] Graceful shutdown
 
-### M3 — Caching
+### M3 — Local DNS Listener
+
+- [ ] UDP listener on configurable port (default 53)
+- [ ] TCP listener on configurable port (default 53)
+- [ ] Receive standard DNS wire-format queries
+- [ ] Forward through DoH pipeline (shared upstream client)
+- [ ] Return DNS wire-format response over UDP/TCP
+- [ ] Config: `[dns]` section with `listen` address
+- [ ] Integration test with UDP/TCP clients
+
+### M4 — Caching
 
 - [ ] In-memory DNS response cache
 - [ ] Cache key = (query name, query type)
@@ -60,21 +74,21 @@ A lightweight DNS-over-HTTPS (DoH) forwarder that accepts DNS queries over HTTPS
 - [ ] Cache eviction (TTL-based + LRU size cap)
 - [ ] Cache stats endpoint (`/cache/stats`)
 
-### M4 — Observability
+### M5 — Observability
 
 - [ ] Structured logging (tracing)
 - [ ] Request logging middleware (query name, type, latency, upstream used)
 - [ ] Health endpoint (`/health`)
 - [ ] Metrics endpoint (optional, Prometheus format)
 
-### M5 — Blocking & Filtering
+### M6 — Blocking & Filtering
 
 - [ ] Domain blocklist (file-based, one domain per line)
 - [ ] Wildcard / suffix matching
 - [ ] Return NXDOMAIN for blocked queries
 - [ ] Hot-reload blocklist on SIGHUP
 
-### M6 — Production Hardening
+### M7 — Production Hardening
 
 - [ ] Rate limiting (per-IP)
 - [ ] Request timeout for upstream queries
@@ -89,11 +103,13 @@ doh-forwarder/
 ├── Cargo.toml
 ├── src/
 │   ├── main.rs            # entrypoint, server setup
+│   ├── lib.rs             # public API re-exports
 │   ├── config.rs          # config parsing
 │   ├── dns/
 │   │   ├── mod.rs
 │   │   ├── query.rs       # parse incoming DNS queries
-│   │   └── response.rs    # build/parse DNS responses
+│   │   ├── response.rs    # build/parse DNS responses
+│   │   └── listener.rs    # UDP/TCP DNS listener
 │   ├── upstream/
 │   │   ├── mod.rs
 │   │   └── doh_client.rs  # DoH forwarding client