Tailscale MagicDNS Name Fails While the Tailscale IP Works

Confirm Tailscale IP reachability from the failing client. Name evidence cannot isolate a MagicDNS problem without a working IP path.[4]

• Yes, the Tailscale IP works → Does only the MagicDNS name fail?
• No, the IP path fails → Use the connectivity diagnosis instead
• Cannot confirm the IP path → Establish the Tailscale IP path

Record whether the peer responds over its Tailscale IP address from the failing client.[4]

Only a proven working IP path continues on this page.[4]

• The Tailscale IP works → Does only the MagicDNS name fail?
• The IP path fails → Use the connectivity diagnosis instead

A peer unreachable by its Tailscale IP has a connectivity problem, not a MagicDNS problem. Prove the IP path first.[4]

Compare the short machine name and the fully qualified tailnet name against the working IP result. Shared devices require the full domain name.[1]

• Yes, only the name fails → Where is this name failure observed?
• No, IP or general DNS also fails → Investigate the general connectivity or DNS problem
• Cannot confirm the name scope → Record the exact name results

Record the short-name, full-name, IP, and general Internet name results separately.[1][2]

Only a name-only failure continues toward MagicDNS layers.[1]

• Only the MagicDNS name fails → Where is this name failure observed?
• IP or general DNS also fails → Investigate the general connectivity or DNS problem

A failure beyond the MagicDNS name is outside this page: prove the IP path or diagnose general DNS before returning here.[2][4]

Exit-path, Synology-scoped, and shared-device observations each belong to their owning diagnosis. Only a plain tailnet name failure continues here.[6][1]

• Plain tailnet peer → Is MagicDNS enabled and does the machine record match?
• Only through an exit node → Use the exit-node diagnosis instead
• Synology service or port → Use the Synology NAS diagnosis instead
• Device shared from another tailnet → Use the full domain name for shared devices

If the name failure exists only while traffic/DNS uses the selected exit node, stay in the exit-node diagnosis. If the same MagicDNS name also fails on the normal tailnet path, return to this MagicDNS page.[6]

A Synology service or port questioned only by name belongs to the Synology NAS diagnosis, which owns its service and DNS branches.[1]

Devices shared from another tailnet require the full domain name; the short machine name alone is not sufficient.[1]

Check the admin console DNS page for MagicDNS enablement and the tailnet DNS name state. Separately, check the target machine record for its current machine name and documented fully qualified tailnet name.[1]

• Yes, enablement and name look correct → Does the fully qualified name work while the short name fails?
• No, enablement or name is wrong → Hand tailnet DNS evidence to the tailnet admin
• Cannot confirm the tailnet state → Record the tailnet DNS state

Record the admin console DNS state (MagicDNS enablement, tailnet DNS name) and, separately, the machine record (machine name, fully qualified tailnet name) without changing shared settings.[1]

Only a correct DNS page state plus a matching machine record continues toward client layers.[1]

• Enablement and name look correct → Does the fully qualified name work while the short name fails?
• Enablement or name is wrong → Hand tailnet DNS evidence to the tailnet admin

Preserve the admin console DNS evidence (enablement, tailnet DNS name) and the machine-record evidence (machine name, fully qualified name) for the admin; do not change shared DNS settings as a probe.[1]

Compare the short machine name against the fully qualified tailnet name. Search domains normally bridge the two.[1]

• Yes, only the short name fails → Preserve the search-domain evidence
• No, both name forms fail → Does the client accept and use Tailscale DNS settings?
• Cannot confirm the comparison → Record the short-name versus full-name results

Record both name forms for the same peer without changing anything else.[1]

The short-versus-full comparison separates search-domain evidence from deeper DNS layers.[1]

• Only the short name fails → Preserve the search-domain evidence
• Both name forms fail → Does the client accept and use Tailscale DNS settings?

With the full name working, record the short-name failure with client and tailnet DNS state for admin review instead of rewriting resolver configuration as a probe.[1]

Check the documented client DNS preference. Ignoring Tailscale DNS settings can prevent the client from using the tailnet DNS configuration and is consistent with a name-only failure, but alone does not prove the cause.[3]

• Yes, the client uses Tailscale DNS → Is there a documented split-DNS, nameserver, or local conflict?
• No, the client ignores Tailscale DNS → Restore the documented client DNS preference
• Cannot confirm the preference → Record the client DNS preference

Record whether the client accepts Tailscale DNS settings through the documented menu or CLI state.[3]

The client preference separates local configuration from tailnet DNS state.[3]

• The client uses Tailscale DNS → Is there a documented split-DNS, nameserver, or local conflict?
• The client ignores Tailscale DNS → Restore the documented client DNS preference

Restore the client to accept Tailscale DNS settings through the documented flow, then re-test both name forms. Changing this preference affects all names on that client.[3]

Configured nameservers, split-DNS behavior, policy-limited nameserver access, or local overrides can each break MagicDNS names with a healthy IP path.[1][2]

• Yes, a documented conflict applies → Resolve only the proven documented conflict
• No, no documented conflict applies → Collect a DNS evidence packet

Hand the exact nameserver, split-DNS, or local-override evidence to the owner of that layer. Do not broaden policy or rewrite resolvers blindly.[1][2]

Preserve the peer IP result, both name-form results, tailnet DNS state, and client DNS preference with all identifiers redacted. Send the sanitized evidence for upstream review.[2]