diff --git a/README.md b/README.md
index 67ca9db..4ea63f8 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,13 @@ It's only enabled for clients which request it.
 Add `dd` prefix to secret (`cafe...babe` => `ddcafe...babe`) to enable
 this mode on client side.
 
+## TLS-transport
+Set tag with argument: `-D <domain>`, the domain must support TLS 1.3.
+
+The secret has this format: `ee` + `<secret>` + `<domain> (in hex format)`
+
+When using this protocol, all others are disabled. Also, it is not recommended to set the value of workers for better replay protection.
+
 ## Systemd example configuration
 1. Create systemd service file (it's standard path for the most Linux distros, but you should check it before):
 ```bash