diff --git a/Cargo.lock b/Cargo.lock
index 6ff0128..2587b25 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -476,6 +476,17 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
+[[package]]
+name = "console_log"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be8aed40e4edbf4d3b4431ab260b63fdc40f5780a4766824329ea0f1eefe3c0f"
+dependencies = [
+ "log",
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -2068,11 +2079,13 @@ dependencies = [
  "axum-server",
  "base64 0.22.1",
  "bytes",
+ "console_log",
  "cookie",
  "cookie_store",
  "futures-lite",
  "futures-util",
  "js-sys",
+ "log",
  "pkarr",
  "pubky-common",
  "pubky-homeserver",
diff --git a/pubky-homeserver/src/io/pkarr.rs b/pubky-homeserver/src/io/pkarr.rs
index 7a79273..4f8bfd6 100644
--- a/pubky-homeserver/src/io/pkarr.rs
+++ b/pubky-homeserver/src/io/pkarr.rs
@@ -54,10 +54,8 @@ pub fn create_signed_packet(config: &Config, port: u16) -> Result<SignedPacket>
     let mut signed_packet_builder =
         SignedPacket::builder().https(".".try_into().unwrap(), svcb.clone(), 60 * 60);
 
-    if config.domain.is_none() {
-        // TODO: remove after remvoing Pubky shared/public
-        // and add local host IP address instead.
-        svcb.target = "localhost".try_into().unwrap();
+    if config.testnet {
+        svcb.target = "localhost".try_into().expect("localhost is valid dns name");
 
         signed_packet_builder = signed_packet_builder
             .https(".".try_into().unwrap(), svcb, 60 * 60)
@@ -66,9 +64,13 @@ pub fn create_signed_packet(config: &Config, port: u16) -> Result<SignedPacket>
                 "127.0.0.1".parse().unwrap(),
                 60 * 60,
             );
+    } else if let Some(ref domain) = config.domain {
+        svcb.target = domain.as_str().try_into()?;
+
+        signed_packet_builder = signed_packet_builder.https(".".try_into().unwrap(), svcb, 60 * 60);
     }
 
-    // TODO: announce A/AAAA records as well for TLS connections?
+    // TODO: announce public IP with A/AAAA records (need to add options in config)
 
     Ok(signed_packet_builder.build(&config.keypair)?)
 }
diff --git a/pubky/Cargo.toml b/pubky/Cargo.toml
index 8d4cf2a..72d821a 100644
--- a/pubky/Cargo.toml
+++ b/pubky/Cargo.toml
@@ -35,6 +35,8 @@ reqwest = { version = "0.12.9", default-features = false }
 futures-lite = { version = "2.5.0", default-features = false }
 wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
+console_log = { version = "1.0.0", features = ["color"] }
+log = "0.4.22"
 
 js-sys = "0.3.76"
 web-sys = "0.3.76"
diff --git a/pubky/src/lib.rs b/pubky/src/lib.rs
index 53eb12a..951bd62 100644
--- a/pubky/src/lib.rs
+++ b/pubky/src/lib.rs
@@ -27,6 +27,9 @@ pub struct Client {
     cookie_store: std::sync::Arc<native::CookieJar>,
     #[cfg(not(target_arch = "wasm32"))]
     icann_http: reqwest::Client,
+
+    #[cfg(target_arch = "wasm32")]
+    testnet: bool,
 }
 
 impl Debug for Client {
diff --git a/pubky/src/wasm.rs b/pubky/src/wasm.rs
index 5c71155..8322694 100644
--- a/pubky/src/wasm.rs
+++ b/pubky/src/wasm.rs
@@ -23,6 +23,7 @@ impl Client {
         Self {
             http: reqwest::Client::builder().build().unwrap(),
             pkarr: pkarr::Client::builder().build().unwrap(),
+            testnet: false,
         }
     }
 
@@ -41,6 +42,23 @@ impl Client {
                 )
                 .build()
                 .unwrap(),
+            testnet: true,
         }
     }
 }
+
+#[wasm_bindgen(js_name = "setLogLevel")]
+pub fn set_log_level(level: &str) -> Result<(), JsValue> {
+    let level = match level.to_lowercase().as_str() {
+        "error" => log::Level::Error,
+        "warn" => log::Level::Warn,
+        "info" => log::Level::Info,
+        "debug" => log::Level::Debug,
+        "trace" => log::Level::Trace,
+        _ => return Err(JsValue::from_str("Invalid log level")),
+    };
+
+    console_log::init_with_level(level).map_err(|e| JsValue::from_str(&e.to_string()))?;
+    log::info!("Log level set to: {}", level);
+    Ok(())
+}
diff --git a/pubky/src/wasm/internals.rs b/pubky/src/wasm/internals.rs
index 4fbdc5e..3634f76 100644
--- a/pubky/src/wasm/internals.rs
+++ b/pubky/src/wasm/internals.rs
@@ -24,15 +24,20 @@ impl Client {
 
     pub(super) async fn transform_url(&self, url: &mut Url) {
         if url.scheme() == "pubky" {
-            // TODO: use https for anything other than testnet
-            url.set_scheme("http")
-                .expect("couldn't replace pubky:// with http://");
+            url.set_scheme("https")
+                .expect("couldn't replace pubky:// with https://");
             url.set_host(Some(&format!("_pubky.{}", url.host_str().unwrap_or(""))))
                 .expect("couldn't map pubk://<pubky> to https://_pubky.<pubky>");
         }
 
         let qname = url.host_str().unwrap_or("").to_string();
 
+        // TODO: detect loopback IPs and other equivilants to localhost
+        if qname == "localhost" && self.testnet {
+            url.set_scheme("http")
+                .expect("couldn't replace pubky:// with http://");
+        }
+
         if PublicKey::try_from(qname.to_string()).is_ok() {
             let mut stream = self.pkarr.resolve_https_endpoints(&qname);
 
@@ -57,5 +62,7 @@ impl Client {
                 // TODO: didn't find any domain, what to do?
             }
         }
+
+        log::debug!("Transformed URL to: {}", url.as_str());
     }
 }