diff --git a/crates/wtfnet-dnsleak/src/sensor.rs b/crates/wtfnet-dnsleak/src/sensor.rs
index 81a72aa..ced374e 100644
--- a/crates/wtfnet-dnsleak/src/sensor.rs
+++ b/crates/wtfnet-dnsleak/src/sensor.rs
@@ -265,6 +265,7 @@ fn select_interface(
 ) -> Result<(datalink::NetworkInterface, Box<dyn datalink::DataLinkReceiver>), DnsLeakError> {
     let interfaces = datalink::interfaces();
     if let Some(name) = name {
+        debug!("dns leak iface pick: requested={name}");
         let iface = interfaces
             .iter()
             .find(|iface| iface.name == name)
@@ -284,12 +285,14 @@ fn select_interface(
     }
 
     if let Some(iface) = pick_stable_iface(&interfaces) {
+        debug!("dns leak iface pick: stable={}", iface.name);
         if let Ok(channel) = open_channel_with_timeout(iface, config) {
             return Ok(channel);
         }
     }
 
     for iface in interfaces.iter() {
+        debug!("dns leak iface pick: try={}", iface.name);
         if let Ok(channel) = open_channel_with_timeout(iface.clone(), config) {
             return Ok(channel);
         }
diff --git a/docs/dns_leak_implementation_status.md b/docs/dns_leak_implementation_status.md
index 3923ef4..4536473 100644
--- a/docs/dns_leak_implementation_status.md
+++ b/docs/dns_leak_implementation_status.md
@@ -26,6 +26,7 @@ This document tracks the current DNS leak detector implementation against the de
 - Interface selection:
   - per-interface open timeout to avoid capture hangs
   - stable default pick (up, non-loopback, named ethernet/wlan) before fallback scan
+  - verbose logging of interface selection attempts (use `-v` / `-vv`)
 
 ## Partially implemented
 - Route/interface classification: heuristic only (loopback/tunnel/physical by iface name).