Docs / Admin

DNS in Tailscale

Tailscale provides each device on your network with a unique IP address that stays the same no matter where your devices are. However, IP addresses aren’t very memorable, and can be unwieldy to work with. You can map Tailscale IPs to human readable names using DNS.

You can manage DNS for your Tailscale network in at least three ways:

  • Using MagicDNS, our automatic DNS feature
  • Using the DNS settings page in the admin console
  • Using public DNS records

Using MagicDNS

Tailscale can automatically assign DNS names for devices in your network. This feature, called “MagicDNS” is in beta.

Read more about MagicDNS →

Using DNS settings in the admin console

Tailscale’s admin console has a DNS page that lets you configure settings for your network:

A screenshot of the admin console's DNS settings

MagicDNS determines whether your network will use the MagicDNS beta to automatically assign DNS names to devices in your network. MagicDNS is optional, and not required to use other DNS settings.

Nameservers are the IPv4 or IPv6 addresses of DNS servers you want your Tailscale nodes to use for lookups, when connected to your network. Many companies have internal private DNS servers with the names of their private machines. If so, you can add those DNS servers here.

There are two types of nameservers:

  • Restricted Nameservers (also known as Split DNS) only apply to DNS queries matching a certain search domain. If you configure as a nameserver for, only DNS queries like “” and “” will be handled by

    These nameservers also configure search domains for your devices, which expand single-label queries like “foo” into “” or “bar” into “”.

  • Global Nameservers handle DNS queries for any domain. By default, clients of your network will use their local DNS settings for all queries. To force clients to always use nameservers you define, you can enable the “Override local DNS” toggle.

Unless your nameservers are public, or using Tailscale IP addresses, you will probably need to configure subnet routing so your nodes can reach the private DNS servers.

Using a public DNS subdomain

If you’d prefer not to manage DNS settings via the admin console, you can instead publish records on your public-facing DNS server, assuming you have one. The DNS names can be looked up (converted to a private IP address) by anyone on the Internet, but because Tailscale IP addresses are only accessible to users your network, this is relatively harmless.

Almost every organization already has a public DNS server (so that they can route email, publish a web site, etc), so this is easier than setting up an internal private DNS server.

Tailscale does not offer a DNS server, so you will need to use one that you run yourself, or one offered by your cloud or domain host, or by some other DNS provider. Note that public DNS names may take a while to propagate once you add them.


Why is a global nameserver required for Split DNS or MagicDNS?

The short answer is… DNS is complicated. On some platforms in some situations, Tailscale needs a trustworthy public resolver to use for DNS. We hope to remove this restriction in the near future.

How can I define a search domain without a nameserver?

Previous versions of the DNS settings page allowed defining search domains separately from nameservers. However, due to cross-platform compatibility reasons, this is no longer possible. To define a search domain, you’ll need to add at least one nameserver along with it.

If you don’t have a preference, we recommend using well-trusted public DNS nameservers alongside your search domain.

Can I add arbitrary DNS records to MagicDNS?

Adding arbitrary records isn’t possible right now, but we’re considering adding this ability in the future. Subscribe to or comment on this GitHub issue for updates.

How can I test my DNS configuration?

Traditionally, network admins will use a tool like nslookup to review DNS responses for various domains. However, on some platforms nslookup doesn’t use DNS information provided by the OS, and returns incorrect results. You’ll likely notice this issue when using Split DNS or MagicDNS, which rely on advanced DNS features.

To test DNS settings on different platforms, we recommend the following approaches:


Use the native dscacheutil command:

dscacheutil -q host -a name <domain-or-magic-dns-hostname>

For example, searching up the IP address for a MagicDNS hostname will return:

$ dscacheutil -q host -a name my-server


Use the Windows Powershell Resolve-DnsName command

Resolve-DnsName -Name <domain-or-magic-dns-hostname>

For example, searching up a MagicDNS hostname will return:

PS C:\> Resolve-DnsName -Name my-server

Name                                       Type   TTL   Section   IPAddress
----                                       ----   ---   -------   ---------   AAAA   600   Answer    fd7a:115c:a1e0:ab12:4843:cd96:6251:c348   A      600   Answer

Linux implements its DNS support using a DNS server listening on 127.0.0.x, so nslookup returns correct results in spite of its naive approach. Use nslookup to debug DNS responses on Linux.

Last updated

WireGuard is a registered
trademark of Jason A. Donenfeld.

© 2021 Tailscale Inc.

Privacy & Terms