diff --git a/internal/dnsforward/upstreams.go b/internal/dnsforward/upstreams.go
index 0754daae..6fbe0638 100644
--- a/internal/dnsforward/upstreams.go
+++ b/internal/dnsforward/upstreams.go
@@ -103,20 +103,18 @@ func newPrivateConfig(
 		}
 	}
 
-	log.Debug("dnsforward: upstreams to resolve ptr for local addresses: %v", addrs)
+	log.Debug("dnsforward: private-use upstreams: %v", addrs)
 
 	uc, err = proxy.ParseUpstreamsConfig(addrs, opts)
 	if err != nil {
 		return uc, fmt.Errorf("preparing private upstreams: %w", err)
 	}
 
-	if !confNeedsFiltering {
-		return uc, nil
-	}
-
-	err = filterOutAddrs(uc, unwanted)
-	if err != nil {
-		return uc, fmt.Errorf("filtering private upstreams: %w", err)
+	if confNeedsFiltering {
+		err = filterOutAddrs(uc, unwanted)
+		if err != nil {
+			return uc, fmt.Errorf("filtering private upstreams: %w", err)
+		}
 	}
 
 	// Prevalidate the config to catch the exact error before creating proxy.
diff --git a/internal/home/dns.go b/internal/home/dns.go
index d64effd5..53ea5247 100644
--- a/internal/home/dns.go
+++ b/internal/home/dns.go
@@ -156,7 +156,7 @@ func initDNSServer(
 	}
 
 	// Try to prepare the server with disabled private RDNS resolution if it
-	// failed to prepare as is.  See TODO on [ErrBadPrivateRDNSUpstreams].
+	// failed to prepare as is.  See TODO on [dnsforward.PrivateRDNSError].
 	err = Context.dnsServer.Prepare(dnsConf)
 	if privRDNSErr := (&dnsforward.PrivateRDNSError{}); errors.As(err, &privRDNSErr) {
 		log.Info("WARNING: %s; trying to disable private RDNS resolution", err)