diff --git a/DEPLOY.md b/DEPLOY.md
index 9c8c815..b965d6c 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -7,9 +7,9 @@ TLS is only a concern for servers. Members connect outbound and need no domain,
 ## Member node (zero TLS work)
 
 ```
-frxd init --name alice --id alice.frx.example \
-  --registry https://ma.example.com/registry.json --ma-key <ma-hex> \
-  --relay https://relay.example.com --data-dir ./alice-data
+frxd init --name alice --id alice.frx.federatedsearch.org \
+  --registry https://ma.federatedsearch.org/registry.json --ma-key <ma-hex> \
+  --relay https://relay.federatedsearch.org --data-dir ./alice-data
 frxd add ~/documents --name docs --shared --exposure full
 frxd serve
 ```
@@ -23,8 +23,8 @@ Identity registration stays with the MA; the wizard only consumes the credential
 MA operator — run the signup site:
 
 ```
-frxd registry --dir ./ma init --zone frx.example
-frxd registry --dir ./ma serve --listen 127.0.0.1:7800 --signup-code <code> --registry-url https://ma.example.com/registry.json
+frxd registry --dir ./ma init --zone frx.federatedsearch.org
+frxd registry --dir ./ma serve --listen 127.0.0.1:7800 --signup-code <code> --registry-url https://ma.federatedsearch.org/registry.json
 ```
 
 (put Caddy in front for a real domain). The page at `/` accepts a label and the signup code and returns a credential block: `id=... token=... registry=... ma_key=...`.
@@ -42,13 +42,13 @@ The wizard asks for a config path, accepts the pasted credential block (or field
 Run `frxd` on loopback and terminate TLS with Caddy:
 
 ```
-caddy reverse-proxy --from relay.example.com --to 127.0.0.1:7700
+caddy reverse-proxy --from relay.federatedsearch.org --to 127.0.0.1:7700
 ```
 
 Caddyfile equivalent:
 
 ```
-relay.example.com {
+relay.federatedsearch.org {
     reverse_proxy 127.0.0.1:7700
 }
 ```
@@ -57,9 +57,9 @@ Relay command (peers and registry gated by the MA):
 
 ```
 frxd relay --listen 127.0.0.1:7700 \
-  --url https://relay.example.com \
-  --peer https://relay2.example.com \
-  --registry https://ma.example.com/registry.json --ma-key <ma-hex>
+  --url https://relay.federatedsearch.org \
+  --peer https://relay2.federatedsearch.org \
+  --registry https://ma.federatedsearch.org/registry.json --ma-key <ma-hex>
 ```
 
 No domain or open ports? Tunnel it:
@@ -78,8 +78,8 @@ After=network-online.target
 
 [Service]
 ExecStart=/usr/local/bin/frxd relay --listen 127.0.0.1:7700 \
-  --url https://relay.example.com \
-  --registry https://ma.example.com/registry.json --ma-key <ma-hex>
+  --url https://relay.federatedsearch.org \
+  --registry https://ma.federatedsearch.org/registry.json --ma-key <ma-hex>
 Restart=on-failure
 DynamicUser=yes
 NoNewPrivileges=yes
@@ -96,7 +96,7 @@ The same unit shape works for `frxd serve` (add `--config /etc/frxd/frxd.toml`).
 
 ```
 frxd registry --dir /var/lib/frxd/registry init
-frxd registry --dir /var/lib/frxd/registry add alice.frx.example <key> --enc-key <enc>
+frxd registry --dir /var/lib/frxd/registry add alice.frx.federatedsearch.org <key> --enc-key <enc>
 frxd registry --dir /var/lib/frxd/registry serve --listen 127.0.0.1:7800
 ```
 
diff --git a/DESIGN.md b/DESIGN.md
index 5387d63..8eb5094 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -34,7 +34,7 @@ responder --unicast(signed ciphertext)--> relay network --> querier mailbox
 
 ## 4. Identity and trust
 
-- **Identifier**: an MA-hosted FQDN (`alice.frx.example`). No member-controlled DNS is required. Member-hosted identifiers (keys published in the member's own DNS, allowlisted by the MA) are planned, not normative.
+- **Identifier**: an MA-hosted FQDN (`alice.frx.federatedsearch.org`). No member-controlled DNS is required. Member-hosted identifiers (keys published in the member's own DNS, allowlisted by the MA) are planned, not normative.
 - **Credentials**: keys are rotatable and carry validity windows; multiple keys may be valid during rotation. Rotation publishes a successor before retiring the predecessor; revocation removes a key or shortens validity. A key never extends its own authority.
 - **Registry trust**: nodes pin the MA key. Snapshots are versioned (rollback rejected), signature-verified, and cached; registry outage fails static on the last validated snapshot. Open bootstrap requires an explicit development flag.
 - **Envelope authentication**: `{type, from, key, ts, nonce, body, sig}`; the signature covers the JCS (RFC 8785) canonical form of the unsigned envelope under a versioned prefix, and the receiver verifies both the signature and the registry binding `map[key].id == from`. Golden bytes and a deterministic signature are pinned in `tests/conformance.rs`.