If you've ever set up a friendly public DNS alias for a machine in your tailnet — something like intranet.company.com CNAME → something.ts.net — you've probably noticed it works fine on macOS and iOS but dies with DNS_PROBE_FINISHED_NXDOMAIN on Android and Windows.
Why it happens: when a device asks Tailscale's resolver (100.100.100.100) for intranet.company.com, the query gets forwarded to public DNS. Public DNS returns the CNAME — but it can't resolve something.ts.net, because that name only exists inside your tailnet. So the answer comes back half-finished: an alias, no IP. Tailscale's resolver passes that half-answer to the app as-is, even though it's the one server that does know the address. Apple's resolver quietly re-queries the CNAME target itself (hiding the bug), while Android and Windows trust the DNS server to finish the job — so they fail.
This has been broken since at least 2022: #7650 (92 👍), plus duplicates #5033, #12089, #14258, #18312, #19122. The workarounds all hurt: publishing private 100.x IPs in public DNS (impossible for nodes shared across tailnets — each tailnet sees a different IP), Pi-hole/AdGuard rewrites, CoreDNS forwarding hacks, hosts-file entries.
Disclosure: I wrote a fix — PR #21010. It deliberately does not turn 100.100.100.100 into a recursive resolver (the concern that stalled #7650 back in 2023): when a forwarded answer is a CNAME chain ending at a name MagicDNS already knows, the resolver just appends that one local address to the reply. No extra upstream queries, no DNS takeover, and anything malformed or unsupported passes through byte-for-byte. Validated with wire-level tests, fuzzing, race detector, and red/green on an Android 16 emulator.
It hit every Android/Windows user at our company (ClickHouse), which is what finally pushed me to fix it. If this bug has bitten you too, your use case on the issue thread is genuinely helpful for the maintainers deciding whether to pick it up.
At the moment waiting for a review 🙏
Whoa!
Found this (exactly what i have fixed): https://www.reddit.com/r/Tailscale/comments/1t5fk3f/psa_dont_use_cnames_pointing_to_tailscale/
Source: r/Tailscale · by /u/lick_my_code