MagicDNS doesn‘t resolve hostname

[vwkd]

What is the issue?

I'm running Tailscale with a client and a server in the same local network. The server has Tailscale SSH activated. Tailscale account has default settings, so MagicDNS is enabled.

Trying to connect via SSH from the client to the server with ssh user@hostname connects, but asks for the password of the user on the server. Presumably, the hostname resolves to the local IP 192.168.x.y instead of the Tailscale local IP 100.x.y.z. When instead running ssh user@100.x.y.z correctly opens the browser to authenticate with Tailscale.

When client and server aren't on the same local network, the client seems to be able to connect over ssh user@hostname just like over ssh user@100.x.y.z. Though not on iOS where the hostname doesn’t seem to work at all.

It seems there's similar reports, e.g. Reddit.

Steps to reproduce

1. Install Tailscale on the server and activate with sudo tailscale set --ssh.
2. Install Tailscale on the client and activate.
3. Ensure the client is in the same local network as the server.
4. Run ssh user@hostname or connect via SMB smb://hostname, VNC vnc://hostname, etc. in the Finder/Files app on the client.

Expected Result

Opens browser and authenticates with Tailscale.

Actual Result

Asks for password of user.

Are there any recent changes that introduced the issue?

No response

OS version

• Fedora 40
• macOS Sonoma 14.5, iOS 17.5.1

Tailscale version

• 1.68.1

Other software

No response

Bug report

No response

[agottardo]

Presumably, the hostname resolves to the local IP 192.168.x.y instead of the Tailscale local IP 100.x.y.z

What DNS server is your client using? It should be 100.100.100.100 if you want MagicDNS to work.

[vwkd]

The clients use the automatic DNS resolver.

I assume Tailscale VPN already handles DNS since it's resolving hostname to the local 192.168.x.y IP, on macOS at least. I could imagine iOS is doing some kind of shenanigans that avoid the VPN.

[agottardo]

If Tailscale were resolving DNS, hostname would resolve to the Tailscale IP of the device (100.x.y.z). That's why I was asking :)

When Tailscale DNS is enabled on iOS, only DNS queries for tailnet names should go to Tailscale. On macOS, Tailscale handles all DNS. Please share the output of scutil --dns.

What happens if you connect to hostname.tailnet-name.ts.net? Trying to isolate this to a search domain expansion problem.

[vwkd]

Okay, some more experimenting later I figured out that disabling Tailscale on macOS I was still able to connect to hostname on the same LAN, suggesting the router also resolves the bare hostname. So it's not easily clear if hostname resolves through Tailscale or not in the same LAN. On iOS though the bare hostname never worked.

Here's the full results of all connection attempts. Each once via normal SSH and once via SMB for redundancy.

with Tailscale enabled

on macOS

URL	same LAN	different network
hostname	yes	yes
hostname.tailnet-name.ts.net	yes	yes
100.x.y.z	yes	yes
192.168.x.y	yes	no

Logs same LAN

> scutil --dns
DNS configuration

resolver #1
  search domain[0] : tailnet-name.ts.net
  search domain[1] : router.tld
  nameserver[0] : 100.100.100.100
  if_index : 20 (utun5)
  flags    : Supplemental, Request A records, Request AAAA records
  reach    : 0x00000003 (Reachable,Transient Connection)
  order    : 100000

resolver #2
  nameserver[0] : 192.168.0.1
  nameserver[1] : 2001:db8:3333:4444:5555:6666:7777:8888
  nameserver[2] : 2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF
  if_index : 12 (en0)
  flags    : Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)
  order    : 200000

resolver #3
  domain   : tailnet-name.ts.net.
  nameserver[0] : 100.100.100.100
  if_index : 20 (utun5)
  flags    : Supplemental, Request A records, Request AAAA records
  reach    : 0x00000003 (Reachable,Transient Connection)
  order    : 100001

resolver #4
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #5
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #6
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #7
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #8
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #9
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : router.tld
  nameserver[0] : 192.168.0.1
  nameserver[1] : 2001:db8:3333:4444:5555:6666:7777:8888
  nameserver[2] : 2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF
  if_index : 12 (en0)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  search domain[0] : tailnet-name.ts.net
  nameserver[0] : 100.100.100.100
  if_index : 20 (utun5)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00000003 (Reachable,Transient Connection)

Logs different network

> scutil --dns
DNS configuration

resolver #1
  search domain[0] : tailnet-name.ts.net
  nameserver[0] : 100.100.100.100
  if_index : 20 (utun5)
  flags    : Supplemental, Request A records, Request AAAA records
  reach    : 0x00000003 (Reachable,Transient Connection)
  order    : 100200

resolver #2
  nameserver[0] : fe80::1ff:fe23:4567:890a%eth2
  if_index : 12 (en0)
  flags    : Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)
  order    : 200000

resolver #3
  domain   : tailnet-name.ts.net.
  nameserver[0] : 100.100.100.100
  if_index : 20 (utun5)
  flags    : Supplemental, Request A records, Request AAAA records
  reach    : 0x00000003 (Reachable,Transient Connection)
  order    : 100201

resolver #4
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #5
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #6
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #7
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #8
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #9
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : fe80::1ff:fe23:4567:890a%eth2
  if_index : 12 (en0)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  search domain[0] : tailnet-name.ts.net
  nameserver[0] : 100.100.100.100
  if_index : 20 (utun5)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00000003 (Reachable,Transient Connection)

on iOS

URL	same LAN	different network
hostname	no	no
hostname.tailnet-name.ts.net	no	no
100.x.y.z	yes	yes
192.168.x.y	yes	no

with Tailscale disabled

macOS

URL	same LAN	different network
hostname	yes	no
hostname.tailnet-name.ts.net	no	no
100.x.y.z	no	no
192.168.x.y	yes	no

Logs same LAN

> scutil --dns
DNS configuration

resolver #1
  search domain[0] : router.tld
  nameserver[0] : 192.168.0.1
  nameserver[1] : 2001:db8:3333:4444:5555:6666:7777:8888
  nameserver[2] : 2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF
  if_index : 12 (en0)
  flags    : Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : router.tld
  nameserver[0] : 192.168.0.1
  nameserver[1] : 2001:db8:3333:4444:5555:6666:7777:8888
  nameserver[2] : 2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF
  if_index : 12 (en0)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

Logs different network

> scutil --dns
DNS configuration

resolver #1
  nameserver[0] : fe80::1ff:fe23:4567:890a%eth2
  if_index : 12 (en0)
  flags    : Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : fe80::1ff:fe23:4567:890a%eth2
  if_index : 12 (en0)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

iOS

URL	same LAN	different network
hostname	no	no
hostname.tailnet-name.ts.net	no	no
100.x.y.z	no	no
192.168.x.y	yes	no