Taiscale's DNS settings override DNS apps / configuration profile

[dominikconrads]

What is the issue?

If you want to use Tailscale's MagicDNS, you have to enable Tailscale's DNS settings on macOS. This ensures that the name resolution of devices connected to Tailscale works correctly.
However, Tailscale on macOS has problems in combination with apps or configuration profiles that provide their own DNS servers for the OS (such as nextDNS). When using nextDNS, this leads to nextDNS apparently no longer being used as soon as Tailscale's DNS settings are activated.
This is impractical in that all DNS queries are then answered by Tailscale's DNS server (100.100.100.100) and no longer by the nextDNS servers (which means that any queries can be answered, even those that should actually be blocked by nextDNS).
My understanding is that DNS queries from Tailscale should only be answered for my tailnet in order to realize the name resolution for MagicDNS. But apparently, queries that Tailscale cannot assign to my tailnet are sent to the local DNS server that macOS has received from the local DHCP server - but not to the DNS service that is set via an app or a configuration profile.
The order of the DNS servers is then:
100.100.100.100 (tailscale DNS) -> 192.168.178.1 (local DHCP/DNS server) -> xxx.xxx.xxx.xxx (global DNS of the ISP) -> Internet
Therefore you have to deactivate the use Tailscale DNS settings on macOS at the moment, because otherwise you cannot use the nextDNS DNS servers, but you cannot use the MagicDNS either.
This behavior is only present on macOS. On iOS/iPadOS and on Windows, the problem does not exist if you use Tailscale's DNS settings and nextDNS at the same time. Everything works correctly as expected on these platforms.
I am aware that nextDNS can also be set as a global name server in the Tailscale admin UI, but this is then inevitably activated for all clients. However, I do not want to do this, as I only want to use nextDNS on Apple devices for certain reasons.
Therefore, I suspect a bug in the DNS implementation of Tailscale on macOS**, which bypasses DNS servers through other VPN apps or configuration profiles by always selecting the local DNS server (which is propagated by the DHCP server) of the current network interface.
The order of the DNS servers should look like this (if use Tailscale DNS settings and nextDNS is activated):
100.100.100.100 (Tailscale DNS) -> xxx.xxx.xxx.xxx (public DNS server nextDNS) -> Internet

** There is no difference in behavior between App Store and .pkg file variant. The error occurs in both versions, this has already been verified.

Steps to reproduce

1. use macOS 15.4
2. install Tailscale (from the App Store or website)
3. install nextDNS (from the App Store or configuration profile)
4. activate both apps as VPN in macOS settings
5. contect to your Tailscale
6. check status on https://my.nextdns.io/ if it shows 'All good! This device is using NextDNS with this profile.'
7. enable 'use Tailscale DNS settings'
8. check status on https://my.nextdns.io/ if it shows 'This device is not using NextDNS.
   This device is currently using ”$localdnsprovider” as DNS resolver.

Are there any recent changes that introduced the issue?

No response

OS

macOS

OS version

15.4

Tailscale version

1.82.0

Other software

• nextDNS (from the App Store)

Bug report

BUG-f7f0323369db8e26dd7ceed0ee04f70025386d8fb8ecded532f129c26d7a57ee-20250402192031Z-f8e099cb37d3c8d0

[barnstar]

@dominikconrads Ideally, this should be set up in the control panel (but as you noted, we do not yet support per-device DNS configuration). As a workaround, set the NextDNS v4 and v6 dns server IPs manually as the DNS servers for your interface per their instructions. This will force MagicDNS to forward your queries via NextDNS instead of the default interface nameserver. You can do this only on the Tailscale devices you want using NextDNS. This should apply globally.

[dominikconrads]

@barnstar At the moment, this seems to be the only alternative as a real workaround. However, this also has the disadvantage that NextDNS can no longer be temporarily deactivated as a DNS server (e.g. because a website would otherwise not load). However, the implementation as a native VPN app or proxy via configuration profile allows this.
There doesn't seem to be an elegant solution at the moment, at least until Tailscale supports a per-device DNS configuration for the global nameserver.
I am only surprised that this works on iOS/iPadOS without problems, where requests that cannot be answered by Tailscale seem to be properly returned to the system, which in turn queries the NextDNS as DNS server and not the default DNS server from the actual interface (Wi-Fi/cellular).

[paull27]

It seems to be related to this issue on iOS, which can be fixed by using the iOS-specific

"nodeAttrs": [
		{
			"target": ["autogroup:member"],
			"attr":   ["disable-split-dns-when-no-custom-resolvers"],
		},
]

But on macOS the issue persists. Secure DNS via configuration profiles is ignored when Tailscale magic DNS is active.

It is also regardless of the macOS App Store variant and standalone version.

[l2dy]

Is this issue a duplicate of #14714? We should centralize +1 votes there for better visibility.