Tailscale内部DNS服务器地址解析失败问题求助

配置背景 #

• 在Linux节点上配置了192.168.77.0/24子网路由，已完成公告和控制台审批，授权节点可通过IP访问内部服务
• DNS设置：添加内部DNS服务器192.168.77.11、192.168.77.13，限定仅用于intranet-mvp.ch域名；设置intranet-mvp.ch为搜索域

故障现象 #

• 可访问内部IP，但无法解析域名：
  • tailscale dns query能成功解析完整域名（如apsrepository.intranet-mvp.ch），但nslookup无法解析
  • 短域名（如apsrepository）在两种方式下均解析失败

相关命令输出 #

C:\Users\olivier.boudry\Downloads>tailscale dns status

=== 'Use Tailscale DNS' status ===

Tailscale DNS: enabled.

Tailscale is configured to handle DNS queries on this device.
Run 'tailscale set --accept-dns=false' to revert to your system default DNS resolver.

=== MagicDNS configuration ===

This is the DNS configuration provided by the coordination server to this device.

MagicDNS: enabled tailnet-wide (suffix = tailxxxxxx.ts.net)

Other devices in your tailnet can reach this device at mvp-wksch-0190.tailxxxxxx.ts.net.

Resolvers (in preference order):
  (no resolvers configured, system default will be used: see 'System DNS configuration' below)

Split DNS Routes:
  - intranet-mvp.ch                -> 192.168.77.11
  - intranet-mvp.ch                -> 192.168.77.13
  - ts.net.                        -> 199.247.155.53
  - ts.net.                        -> 2620:111:8007::53

Search Domains:
  - intranet-mvp.ch
  - tailxxxxxx.ts.net

=== System DNS configuration ===

This is the DNS configuration that Tailscale believes your operating system is using.
Tailscale may use this configuration if 'Override Local DNS' is disabled in the admin console,
or if no resolvers are provided by the coordination server.

Nameservers:
  - 172.20.10.1

Search domains:
  (no search domains found)

[this is a preliminary version of this command; the output format may change in the future]

C:\Users\olivier.boudry\Downloads>tailscale dns query apsrepository
DNS query for "apsrepository" (A) using internal resolver:

Multiple resolvers available:

Response code: RCodeServerFailure

No answers were returned.

C:\Users\olivier.boudry\Downloads>tailscale dns query apsrepository.intranet-mvp.ch
DNS query for "apsrepository.intranet-mvp.ch" (A) using internal resolver:

Multiple resolvers available:
  - 192.168.77.11
  - 192.168.77.13

Response code: RCodeSuccess

Name                            TTL   Class      Type   Body
----                            ---   -----      ----   ----
apsrepository.intranet-mvp.ch.  3600  ClassINET  TypeA  192.168.77.14

C:\Users\olivier.boudry>nslookup
Serveur par défaut :   UnKnown
Address:  172.20.10.1

> mvpsrv-file
Serveur :   UnKnown
Address:  172.20.10.1

*** UnKnown ne parvient pas à trouver mvpsrv-file : Non-existent domain
> mvpsrv-file.intranet-mvp.ch
Serveur :   UnKnown
Address:  172.20.10.1

*** UnKnown ne parvient pas à trouver mvpsrv-file.intranet-mvp.ch : Non-existent domain
> server 100.100.100.100
Serveur par défaut :   [100.100.100.100]
Address:  100.100.100.100

> mvpsrv-file
Serveur :   [100.100.100.100]
Address:  100.100.100.100

Nom :    mvpsrv-file.intranet-mvp.ch
Address:  192.168.77.39

> mvpsrv-file.intranet-mvp.ch
Serveur :   [100.100.100.100]
Address:  100.100.100.100

Nom :    mvpsrv-file.intranet-mvp.ch
Address:  192.168.77.39

> exit

C:\Users\olivier.boudry>ping 192.168.77.39

Envoi d’une requête 'Ping'  192.168.77.39 avec 32 octets de données :
Réponse de 192.168.77.39 : octets=32 temps=96 ms TTL=126
Réponse de 192.168.77.39 : octets=32 temps=51 ms TTL=126
Réponse de 192.168.77.39 : octets=32 temps=62 ms TTL=126
Réponse de 192.168.77.39 : octets=32 temps=120 ms TTL=126

Statistiques Ping pour 192.168.77.39:
    Paquets : envoyés = 4, reçus = 4, perdus = 0 (perte 0%),
Durée approximative des boucles en millisecondes :
    Minimum = 51ms, Maximum = 120ms, Moyenne = 82ms

C:\Users\olivier.boudry>

排查与解决步骤 #

1. 启用Tailscale控制台的「Override Local DNS」
   登录Tailscale控制台的DNS设置页面，确保Override Local DNS选项已开启。未开启时，Tailscale不会替换系统默认DNS，仅在系统解析失败时接管。

2. 重置Tailscale的DNS配置
   在Windows节点执行以下命令，强制Tailscale重新配置系统DNS：

   tailscale set --accept-dns=false
   tailscale set --accept-dns=true
   

   执行后重启Tailscale服务或重新连接节点，再用ipconfig /all检查系统DNS是否已更新为100.100.100.100。

3. 确认搜索域的系统层面应用
   从输出可见，Tailscale的搜索域包含intranet-mvp.ch但系统层面未同步。可手动在Windows网络适配器的DNS设置中添加intranet-mvp.ch作为搜索域，确保短域名解析时自动补充后缀。

4. 验证内部DNS服务器的可达性
   在Windows节点ping 192.168.77.11和192.168.77.13，确认子网路由已生效，内部DNS服务器可正常访问。

内容的提问来源于stack exchange，提问作者Olivier Boudry