Will HannahandJonathan Nobels 15015f19bf net/dns: scope quad-100 on macOS so DoH profiles aren't shadowed (#20775) ...

* net/dns: scope quad-100 on macOS so DoH profiles aren't shadowed

On sandboxed macOS, an uncovered control ExtraRecord forced quad-100 to
be the primary resolver, proxying all public DNS and shadowing a user's
DoH system profile. Scope quad-100 to its match domains instead, adding
the uncovered host records to MatchDomains so they still resolve while
public names fall through to the OS resolver. quad-100 remains primary
only without a usable base resolver or with non-enumerable MagicDNS
host records.

fixes tailscale/corp#45534

Signed-off-by: Will Hannah <willh@tailscale.com>

* net/dns: move scoped DNS behind an envknob

updates tailscale/corp#45534

Given the sensitivity of this change, let's stuff it behind
a control knob for a release.

Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>

---------

Signed-off-by: Will Hannah <willh@tailscale.com>
Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
Co-authored-by: Jonathan Nobels <jonathan@tailscale.com>

2026-08-07 15:27:22 -04:00

..

controlknobs_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

controlknobs.go

net/dns: scope quad-100 on macOS so DoH profiles aren't shadowed (#20775)

2026-08-07 15:27:22 -04:00