You can use Control D as a Global Nameserver in Tailscale, and take control of your DNS for your entire tailnet.

Create an Endpoint

Head over to the Control D web panel, and create an Endpoint. The type does not matter, but we recommend using "Other" type device from the Routers section.

You will be presented with the Resolvers screen. What you will need from here is the Resolver ID. Copy it.

Configure Nameserver

Now, head over to the Tailscale Console -> DNS section, and scroll down to Global Nameservers.

Choose "Control D" from the dropdown menu. You will see a popup box.

Paste your Resolver ID into the box and press Save. Enable Override DNS servers if you want devices to always use Control D instead of their locally configured DNS servers.

You're done here.

Confirm it Works

The Device you created earlier should have flipped to active state.

You can now head over to Analytics section to view the DNS logs.

Keep in mind that each machine in your tailnet will appear as a distinct client in the Control D dashboard, and you can filter the query data by each machine.

Local DNS and Override DNS Servers

By default, devices in your tailnet prefer their locally configured DNS servers. Enabling Override DNS servers makes devices ignore those local DNS settings and use Control D as the global nameserver.

If you enable Override DNS servers and your devices must resolve internal domains, add the internal DNS server to Tailscale as a restricted nameserver:

Open the DNS page in the Tailscale admin console.
Select Add nameserver, then Custom.
Enter the IP address of your internal DNS server.
Enable Restrict to search domain.
Enter the internal domain, such as corp.example.com, and save the nameserver.

Tailscale will send queries for that domain to the internal DNS server while continuing to send other queries to Control D. The internal DNS server must be reachable from the affected tailnet devices, either directly through Tailscale or through an advertised subnet route.

If you leave Override DNS servers disabled, devices continue to prefer their local DNS settings, so you usually do not need to add internal nameservers to Tailscale. However, Control D is not then forced for every DNS query.

Running ctrld on a Tailnet Machine

If you also run the Command Line Daemon on a machine in your tailnet, Tailscale and ctrld can compete over that machine's DNS settings. Use DNS Intercept Mode on Windows and macOS to avoid that conflict.