Tailscale's exit nodes and subnet routers do different jobs, and picking the wrong one changes where your DNS goes

Published Oct 30, 2026, 6:00 AM EDT Samir Makwana is a technology journalist and editor from India since past 18 years and his work appears on MakeUseOf, HowToGeek, GSMArena, BGR, GuidingTech, The Inquisitr, TechInAsia, TechWiser, and others. He has written news, features, and gadget reviews for national technology media publications. His passion is to help people with their technology problems and gadget purchases. For that, he has worked for some of the biggest international technology publications, covering news, explainers, how-to guides, listicles, and product-buying guides. He has worked as an editor and managed teams since 2015. His expertise broadly covers computers, smartphones, game consoles, headphones, smart home products, browsers, and apps. Tailscale makes it easy to reach my home network and send my traffic through it. Like many folks, I treated the exit nodes and subnet routers as two versions of the same feature. Both need admin approval, forward traffic, and let me reach my home network from a hotel room. Since everything just worked, I never looked closely at how they handle DNS. It turns out they handle it differently. A subnet router changes the devices I can reach from any approved tailnet device. Meanwhile, an exit node changes where my traffic and DNS queries come from. That means if you pick the wrong feature, you won’t see DNS errors because those lookups just get answered somewhere you didn’t intend. A subnet router only exposes the network you point it at It forwards traffic for one IP range and leaves DNS alone By default, enabling subnet routing has no effect on DNS. It makes the devices in a subnet range like 192.168.1.0/24 reachable from your tailnet, and only traffic meant for that range goes through a tunnel to the router. Those devices don’t automatically join the tailnet. With subnet routing, your DNS lookups still go through the free Wi-Fi resolver. That’s because the DNS lookups never go to that range, so they never use the tunnel. Tailscale’s documentation says devices use their local DNS settings by default, so my laptop and phone keep asking the DNS resolver the coffee shop or hotel hands out. You will notice this when trying to use hostnames to access a specific device. If you try looking for it using ssh pi.home.lan, it fails because the local resolver that you’re using away from home doesn’t recognize those names. If you run ssh 192.168.1.30 command in a Terminal, it works because the address falls inside the advertised range. Tailscale's MagicDNS names still work, since the client handles those itself. So your printer behind your home router won't work because it isn't part of the tailnet. The public Wi-Fi still sees every lookup you make, because the subnet router never touches DNS. An exit node moves your DNS to that device’s resolver Your tailnet nameservers get bypassed unless you opt them in Many devices on your tailnet can act as exit nodes, like your home server or Android TV box. When a client selects an exit node, its internet traffic goes through that device. You can set up an exit node at home and use it while traveling. Tailscale’s DNS documentation says a device using an exit node also uses that node as its DNS resolver for all domains, regardless of your global and split DNS nameservers. In practice, your phone sends its DNS lookups through the tunnel to your home server, and the server’s resolver answers them. If that resolver is a Pi-hole, you get to use the same ad block you have on your home Wi-Fi and local hostnames it knows resolve too. If your server uses your ISP’s DNS, then your ISP answers it, and you get no filtering. Either way, the public Wi-Fi sees the lookups because they travel inside an encrypted tunnel. The catch is that this overrides your home network’s DNS configuration. So a Cloudflare or Quad9 nameserver in the router’s admin console gets skipped while an exit node is active, unless you enable the Use with exit node for that nameserver. Pick the wrong one, and you experience problems that look like DNS woes Each mismatch fails in a different, silent way Say you only wanted the hostnames of devices in your home to work on the road, and you turned on an exit node. Those names will probably resolve, but now every website you open uses your home connection’s router, and a Cloudflare or Quad9 resolver you set gets ignored. To solve a naming problem, you need to reroute the whole connection. If you want your Pi-hole’s ad blocking to work everywhere, set up a subnet router. It’s tempting, but your phone still asks the hotel’s resolver. So when ads load as usual, you assume that the Pi-hole is broken. The same thing happens when one device works as a subnet router and an exit node, but your phone never selects the exit node. Since the symptoms show up in DNS, it’s natural to blame the resolver. You can always check which one is actually answering the queries. Run a quick nslookup nas.home.lan command, and if the name resolves, your home DNS is involved. If it doesn’t, your lookups are going somewhere else. When you try this with the exit node on and off once, the difference is obvious. You can steer DNS either with two admin console settings Fixing the DNS for exit nodes and splitting for subnet routing To make the hostnames work with a subnet router, add a split DNS entry. In Tailscale’s admin console, add a restricted nameserver for your home domain, like home.lan, and point it to your home DNS server’s IP. That particular IP sits inside the advertised range, so the lookups go through the subnet router to home. However, Tailscale specifies that the restricted nameserver applies only to DNS queries for a specific search domain. Everything else still goes through the local resolver you use. That means nas.home.lan works, and nothing else gets rerouted. With an exit node, turn on Use with exit node for each nameserver you want to keep. Otherwise, queries fall back to the exit node’s resolver. If you’d rather every device ignore its local DNS and use your tailnet’s name server, enable Override DNS servers on the global nameservers you defined. After that, one always-on machine can also be both a subnet router and an exit node. Choose where your DNS gets answers, and pick the feature To reach home devices while keeping your DNS local, use a subnet router and add split DNS for their hostnames. To have your home resolver answer your lookups, use an exit node and choose which name servers come along. Either way, you’ll need to check which resolver is answering before you trust it. Tailscale Tailscale is a tool that allows you to create specific network connections so you can remotely access resources within a private network.