---
title: "Tailscale DNS — Accessing Internal Domains on Mobile"
aliases: [tailscale-dns, tailscale-override-dns, tailscale-internal-domain, tailscale-adguard]
tags: [tailscale, dns, homelab, adguard, mobile, vpn, networking]
sources:
  - "daily/2026-04-19.md"
created: 2026-04-19
updated: 2026-04-19
---

# Tailscale DNS — Accessing Internal Domains on Mobile

Internal homelab domains (e.g., `home.ai-impress.com`) that are served by a local DNS resolver (AdGuard Home, Pi-hole) are accessible from desktop/laptop because those machines use the local DNS. Mobile devices on Tailscale VPN do not automatically use the homelab DNS — they keep using their cellular or Wi-Fi DNS. The fix: configure Tailscale's Global Nameserver to point at the AdGuard instance and enable **Override local DNS**.

## Key Points

- **Internal domains only resolve if the DNS resolver that knows them is queried** — AdGuard or Pi-hole custom records aren't visible to any other DNS server
- Mobile devices connected to Tailscale still use their default DNS unless Tailscale is configured to override it
- Solution: add the AdGuard/Pi-hole IP as a **Global nameserver** in Tailscale Admin → DNS, and enable **Override local DNS**
- "Override local DNS" forces all DNS queries from Tailscale-connected devices to go through the specified nameserver — including mobile
- The AdGuard instance must be reachable via Tailscale IP or LAN IP from all devices in the tailnet

## Details

### The Problem

Internal DNS records (e.g., `home.ai-impress.com → 192.168.1.62`) live only in AdGuard Home running on the homelab server. When a laptop is on home Wi-Fi, it uses the local router/AdGuard as DNS — the record resolves. When the same laptop is on Tailscale away from home, it depends on Tailscale's DNS config. Mobile devices on Tailscale use their cellular carrier DNS or public Wi-Fi DNS — neither knows about internal records.

### The Fix: Tailscale Admin DNS Configuration

1. Go to **Tailscale Admin → DNS** (https://login.tailscale.com/admin/dns)
2. Under **Nameservers**, click **Add nameserver → Custom**
3. Enter the AdGuard IP: `192.168.1.62` (the LAN IP of the AdGuard host)
4. Check **Override local DNS** — this makes all Tailscale-connected devices use this nameserver
5. Save

After this change, all Tailscale clients (including mobile) send DNS queries to AdGuard Home, which resolves internal records and forwards public queries upstream.

### Security Consideration

With "Override local DNS" enabled, all DNS traffic from Tailscale clients goes through the homelab's AdGuard — even when users are away from home. This is usually desirable (AdGuard blocks ads everywhere) but means:
- The homelab must be running and reachable for DNS to work
- If the homelab goes down, Tailscale clients lose DNS until they disconnect from Tailscale or the server recovers

A fallback nameserver can be added (e.g., `1.1.1.1`) in Tailscale's DNS settings to handle public queries if the primary fails.

### Nginx Security for Internal Domains

When an internal domain resolves only via local/VPN DNS:
- `home.ai-impress.com` resolves to a LAN IP (`192.168.1.62`) only when queried through AdGuard
- Public DNS (e.g., Cloudflare) returns NXDOMAIN or no A record
- Therefore `Allow all` in Nginx is safe — only devices that can resolve the domain (on LAN or Tailscale VPN) can reach it

This is DNS-level access control, not IP allowlist-based. It's appropriate for homelab dashboards that don't contain sensitive data, where the simplicity of "Allow all" is preferred over maintaining IP ranges.

### Services in the Homelab Stack (2026-04-19)

Active services with internal DNS entries:
- `home.ai-impress.com` → Homepage / Dashy dashboard (LXC, port 3000/4000)
- Nextcloud, Karakeep, Portainer, NPM, AdGuard, Proxmox web UI, Kali VM

Decommissioned (removed from dashboard): n8n, Documenso, Supabase, Evolution API, WireGuard

## Related Concepts

- [[wiki/concepts/homepage-proxmox-widget-quirks]] — the dashboard accessed via this DNS setup
- [[wiki/homelab/_index]] — full homelab infrastructure including AdGuard Home setup
- [[wiki/concepts/proxmox-mcp-server]] — Proxmox context for the homelab server

## Sources

- [[daily/2026-04-19.md]] — Phone couldn't access `home.ai-impress.com` via Tailscale; fix was adding `192.168.1.62` as Global nameserver in Tailscale Admin DNS + enabling Override local DNS; Nginx Allow All confirmed safe because domain only resolves through AdGuard
