Tailsacle Leaks DNS Requests to 100.100.100.100

[wingcomm]

What is the issue?

Our firewall is detecting blocked requests to 100.100.100.100 from the latest macOS Tailscale client which tells me that its leaking DNS requests to the public internet instead of handling them internally.

Steps to reproduce

Make some DNS requests.

Are there any recent changes that introduced the issue?

No, the recent upgrade to 1.82.5 did occur recently.

OS

No response

OS version

macOS 15.4.1

Tailscale version

1.82.5

Other software

None

Bug report

BUG-01deeb523b3f156423d6c2bef9f667b8000f4a39bb42f4f8e1d457b5fc1dedaa-20250426195513Z-1e3b83dd420ca9bd

[bradfitz]

100.100.100.100 is the local address on your machine. It's not out on the internet. So it's not leaking.

[wingcomm]

@bradfitz Then why am I getting seeing these packets being blocked by my Ubiquiti network firewall from my Mac on their way to the internet?

[barnstar]

@wingcomm Are these actual queries escaping or are they dns-sd queries happening on up/down? (the questions will be something along the lines of lb._dns-sd._udp.mytailnet.ts.net)

macOS makes a number of dns-sd queries on interface changes with 100.100.100.100 as the dst. Wireshark tells me these get routed to the default interface but (at least on my network) they all come back as unreachable. Bonjour can be disabled if this is concerning.

[barnstar]

Small update here. It's very rare, but I do see the occasional query to 100.100.100.100 (so far only for apple services) leaking during 'tailscale down'.

The change to the DNS config and the routing changes are done in a single API call to NEPacketTunnelProvider on tailscale up (or in in the down case, it's just a side effect of halting the daemon) - but the system applies the dns and routing changes separately and "as it will", which means that there is the possibility of race where a DNS query is routed to the default interface before the system has updated the resolver configuration or vice versa.

[raggi]

I think they're referring to DoT and maybe DoH.