{"slug":"magicdns","title":"MagicDNS","tags":["tailscale","dns"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# MagicDNS\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nMagicDNS automatically registers DNS names for devices in your network.\r\n\r\nMagicDNSis available for [all plans](https://tailscale.com/pricing).\r\n\r\nIf you add a new web server called `my-server` to your network, you no longer need to use its Tailscale IP: using the name `my-server` in your browser's address bar or on the command line will work.\r\n\r\n![Example of a browser window with 'my-server' and a port number in the address bar.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmagic-dns.791ba793.png&w=3840&q=75)\r\n\r\nMagicDNS does not require a [DNS nameserver](https://tailscale.com/docs/reference/dns-in-tailscale#tailscale-dns-settings) if running Tailscale v1.20 or later. Otherwise, your network must have **at least one DNS nameserver set** in the [DNS](https://login.tailscale.com/admin/dns) page of the admin console. These nameservers will receive all DNS queries not handled by MagicDNS.\r\n\r\n## [Enabling MagicDNS](https://tailscale.com/docs/features/magicdns\\#enabling-magicdns)\r\n\r\nTailnets created on or after October 20, 2022 have MagicDNS enabled by default.\r\n\r\nIf not already enabled, you can enable MagicDNS in the [DNS](https://login.tailscale.com/admin/dns) page of the admin console:\r\n\r\n![The 'Enable MagicDNS' button on the admin console.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmagic-dns-toggle.a34b50f9.png&w=1200&q=75)\r\n\r\n## [Accessing devices over MagicDNS](https://tailscale.com/docs/features/magicdns\\#accessing-devices-over-magicdns)\r\n\r\nOnce MagicDNS is enabled, any device signed in to your network can access other devices by using their [machine name](https://tailscale.com/docs/concepts/machine-names). For example, if you have a server named \"monitoring\":\r\n\r\n- To SSH into it, run `ssh username@monitoring`\r\n- To ping it, run `ping monitoring`\r\n- To open it in your browser, type `monitoring` in your address bar.\r\n\r\nSome CLI tools on macOS such as `host` or `nslookup` circumvent system DNS resolution, and will not work with MagicDNS. For example, `host johns-iphone-6s` will not work on macOS, even if `ping johns-iphone-6s` will.\r\n\r\nDevices that are [shared with you](https://tailscale.com/docs/features/sharing) are only accessible via MagicDNS on Tailscale v1.4 or later. You must also use the shared device's [full domain name](https://tailscale.com/docs/features/magicdns#fully-qualified-domain-names-vs-machine-names). For example, `ping webserver.example2.ts.net`.\r\n\r\n## [Assigning and editing machine names](https://tailscale.com/docs/features/magicdns\\#assigning-and-editing-machine-names)\r\n\r\nMagicDNS automatically uses a device's [machine name](https://tailscale.com/docs/concepts/machine-names) as part of the DNS entry. If you change your device's name, the MagicDNS entry will automatically change.\r\n\r\nIf you have a specific name you'd like to use to reference your device, then [edit the machine name](https://tailscale.com/docs/concepts/machine-names#renaming-a-machine) of the device.\r\n\r\n## [Fully qualified domain names vs. machine names](https://tailscale.com/docs/features/magicdns\\#fully-qualified-domain-names-vs-machine-names)\r\n\r\nUnder the hood, MagicDNS generates a **fully qualified domain name** for every device on your Tailscale network (known as a tailnet). The fully qualified domain name is made up of two parts:\r\n\r\n1. A [**machine name**](https://tailscale.com/docs/concepts/machine-names), which you can change.\r\n2. Your [**tailnet DNS name**](https://tailscale.com/docs/concepts/tailnet-name#tailnet-dns-name). You can find your tailnet DNS name in the [DNS](https://login.tailscale.com/admin/dns) page of the admin console.\r\n\r\n![An example of 'monitoring.yak-bebop.ts.net' as a fully qualified domain name. The 'monitoring' segment is identified as the machine name. The 'yak-bebop.ts.net' segment is identified as the tailnet name.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmagic-dns-naming.d6fd44e4.png&w=3840&q=75)\r\n\r\nPreviously, you might have used a [tailnet name](https://tailscale.com/docs/concepts/tailnet-name) ending in `.beta.tailscale.net`. If so, migrate to the new tailnet name ending in `.ts.net`. Support for the existing `beta.tailscale.net` name ended on **September 13, 2024**.\r\n\r\nThe table below shows how some example machine names and domains combine to create the full domain name.\r\n\r\n| Machine Name | Tailnet Name | Fully Qualified Domain Name |\r\n| --- | --- | --- |\r\n| monitoring | yak-bebop.ts.net | `monitoring.yak-bebop.<br>ts.net<br>` |\r\n| johns-iphone-6s | tailab12.ts.net | `johns-iphone-6s.tailab12.<br>ts.net<br>` |\r\n| free-form | example.ts.net | `free-form.example.<br>ts.net<br>` |\r\n\r\nFull domain names can be cumbersome to type, so when you enable MagicDNS, Tailscale automatically adds [search domains](https://tailscale.com/docs/reference/dns-in-tailscale#tailscale-dns-settings) to your network. With these search domains you only need to type the machine name to access a device.\r\n\r\nFor the _yak-bebop_ network, **the following two commands are equivalent**:\r\n\r\n```shell\r\nping monitoring\r\nping monitoring.yak-bebop.ts.net\r\n```\r\n\r\nIn most situations, you'll want to use the machine name. But for security reasons, accessing [devices shared with you](https://tailscale.com/docs/features/sharing) requires using the full domain name.\r\n\r\nYou can find the full domain name of any device in your network by opening its page from the [Machines](https://login.tailscale.com/admin/machines) page of the admin console.\r\n\r\n## [Disabling MagicDNS](https://tailscale.com/docs/features/magicdns\\#disabling-magicdns)\r\n\r\nMagicDNS can be disabled for your whole network by toggling the same button you used to enable it in the [DNS](https://login.tailscale.com/admin/dns) page of the admin console.\r\n\r\nIf you are experiencing trouble with MagicDNS on a particular device and wish to disable it only there, the current solution is to stop accepting network DNS settings in general.\r\n\r\n**On Linux**, stop accepting DNS with:\r\n\r\n```shell\r\ntailscale set --accept-dns=false\r\n```\r\n\r\n**On macOS**, stop accepting DNS by selecting the Tailscale menu bar icon. From here, select **Preferences**, and then you can uncheck **Use Tailscale DNS settings** from the menu.\r\n\r\n**On Windows**, stop accepting DNS by holding `SHIFT` while right-clicking on the Tailscale system tray icon, and deselecting **Use Tailscale DNS** from the menu.\r\n\r\nIn the future, we will have robust enough DNS configuration and resolution logic that disabling MagicDNS separately will never be necessary. At this point, the toggle will disappear.\r\n\r\n## [Removing the `beta.tailscale.net` nameserver](https://tailscale.com/docs/features/magicdns\\#removing-the-betatailscalenet-nameserver)\r\n\r\nSupport for the legacy `*.beta.tailscale.net` nameserver ended on **September 13, 2024**. If you haven't already, migrate your tailnet to use the [tailnet DNS name](https://tailscale.com/docs/concepts/tailnet-name#tailnet-dns-name) format nameserver. If you are no longer using the `beta.tailscale.net` nameserver, you can delete it. Once deleted, you cannot recover it.\r\n\r\nYou need to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to remove the `beta.tailscale.net` nameserver.\r\n\r\n1. Open the [DNS](https://login.tailscale.com/admin/dns) page of the admin console.\r\n2. Under **Nameservers**, look for the nameserver whose name ends in `.beta.tailscale.net`, for example, `yak-bebop.beta.tailscale.net`. (If you don't find a `.beta.tailscale.net` nameserver, there is nothing to delete.)\r\n3. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu and then select **Delete**.\r\n4. Confirm that you want to delete the `beta.tailscale.net` nameserver and then select **Delete**.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>MagicDNS</h1>\n<p>Last validated: Jan 5, 2026</p>\n<p>MagicDNS automatically registers DNS names for devices in your network.</p>\n<p>MagicDNSis available for <a href=\"https://tailscale.com/pricing\">all plans</a>.</p>\n<p>If you add a new web server called <code>my-server</code> to your network, you no longer need to use its Tailscale IP: using the name <code>my-server</code> in your browser's address bar or on the command line will work.</p>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmagic-dns.791ba793.png&#x26;w=3840&#x26;q=75\" alt=\"Example of a browser window with &#x27;my-server&#x27; and a port number in the address bar.\"></p>\n<p>MagicDNS does not require a <a href=\"https://tailscale.com/docs/reference/dns-in-tailscale#tailscale-dns-settings\">DNS nameserver</a> if running Tailscale v1.20 or later. Otherwise, your network must have <strong>at least one DNS nameserver set</strong> in the <a href=\"https://login.tailscale.com/admin/dns\">DNS</a> page of the admin console. These nameservers will receive all DNS queries not handled by MagicDNS.</p>\n<h2><a href=\"https://tailscale.com/docs/features/magicdns#enabling-magicdns\">Enabling MagicDNS</a></h2>\n<p>Tailnets created on or after October 20, 2022 have MagicDNS enabled by default.</p>\n<p>If not already enabled, you can enable MagicDNS in the <a href=\"https://login.tailscale.com/admin/dns\">DNS</a> page of the admin console:</p>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmagic-dns-toggle.a34b50f9.png&#x26;w=1200&#x26;q=75\" alt=\"The &#x27;Enable MagicDNS&#x27; button on the admin console.\"></p>\n<h2><a href=\"https://tailscale.com/docs/features/magicdns#accessing-devices-over-magicdns\">Accessing devices over MagicDNS</a></h2>\n<p>Once MagicDNS is enabled, any device signed in to your network can access other devices by using their <a href=\"https://tailscale.com/docs/concepts/machine-names\">machine name</a>. For example, if you have a server named \"monitoring\":</p>\n<ul>\n<li>To SSH into it, run <code>ssh username@monitoring</code></li>\n<li>To ping it, run <code>ping monitoring</code></li>\n<li>To open it in your browser, type <code>monitoring</code> in your address bar.</li>\n</ul>\n<p>Some CLI tools on macOS such as <code>host</code> or <code>nslookup</code> circumvent system DNS resolution, and will not work with MagicDNS. For example, <code>host johns-iphone-6s</code> will not work on macOS, even if <code>ping johns-iphone-6s</code> will.</p>\n<p>Devices that are <a href=\"https://tailscale.com/docs/features/sharing\">shared with you</a> are only accessible via MagicDNS on Tailscale v1.4 or later. You must also use the shared device's <a href=\"https://tailscale.com/docs/features/magicdns#fully-qualified-domain-names-vs-machine-names\">full domain name</a>. For example, <code>ping webserver.example2.ts.net</code>.</p>\n<h2><a href=\"https://tailscale.com/docs/features/magicdns#assigning-and-editing-machine-names\">Assigning and editing machine names</a></h2>\n<p>MagicDNS automatically uses a device's <a href=\"https://tailscale.com/docs/concepts/machine-names\">machine name</a> as part of the DNS entry. If you change your device's name, the MagicDNS entry will automatically change.</p>\n<p>If you have a specific name you'd like to use to reference your device, then <a href=\"https://tailscale.com/docs/concepts/machine-names#renaming-a-machine\">edit the machine name</a> of the device.</p>\n<h2><a href=\"https://tailscale.com/docs/features/magicdns#fully-qualified-domain-names-vs-machine-names\">Fully qualified domain names vs. machine names</a></h2>\n<p>Under the hood, MagicDNS generates a <strong>fully qualified domain name</strong> for every device on your Tailscale network (known as a tailnet). The fully qualified domain name is made up of two parts:</p>\n<ol>\n<li>A <a href=\"https://tailscale.com/docs/concepts/machine-names\"><strong>machine name</strong></a>, which you can change.</li>\n<li>Your <a href=\"https://tailscale.com/docs/concepts/tailnet-name#tailnet-dns-name\"><strong>tailnet DNS name</strong></a>. You can find your tailnet DNS name in the <a href=\"https://login.tailscale.com/admin/dns\">DNS</a> page of the admin console.</li>\n</ol>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmagic-dns-naming.d6fd44e4.png&#x26;w=3840&#x26;q=75\" alt=\"An example of &#x27;monitoring.yak-bebop.ts.net&#x27; as a fully qualified domain name. The &#x27;monitoring&#x27; segment is identified as the machine name. The &#x27;yak-bebop.ts.net&#x27; segment is identified as the tailnet name.\"></p>\n<p>Previously, you might have used a <a href=\"https://tailscale.com/docs/concepts/tailnet-name\">tailnet name</a> ending in <code>.beta.tailscale.net</code>. If so, migrate to the new tailnet name ending in <code>.ts.net</code>. Support for the existing <code>beta.tailscale.net</code> name ended on <strong>September 13, 2024</strong>.</p>\n<p>The table below shows how some example machine names and domains combine to create the full domain name.</p>\n<p>| Machine Name | Tailnet Name | Fully Qualified Domain Name |\r\n| --- | --- | --- |\r\n| monitoring | yak-bebop.ts.net | <code>monitoring.yak-bebop.&#x3C;br>ts.net&#x3C;br></code> |\r\n| johns-iphone-6s | tailab12.ts.net | <code>johns-iphone-6s.tailab12.&#x3C;br>ts.net&#x3C;br></code> |\r\n| free-form | example.ts.net | <code>free-form.example.&#x3C;br>ts.net&#x3C;br></code> |</p>\n<p>Full domain names can be cumbersome to type, so when you enable MagicDNS, Tailscale automatically adds <a href=\"https://tailscale.com/docs/reference/dns-in-tailscale#tailscale-dns-settings\">search domains</a> to your network. With these search domains you only need to type the machine name to access a device.</p>\n<p>For the <em>yak-bebop</em> network, <strong>the following two commands are equivalent</strong>:</p>\n<pre><code class=\"language-shell\">ping monitoring\r\nping monitoring.yak-bebop.ts.net\n</code></pre>\n<p>In most situations, you'll want to use the machine name. But for security reasons, accessing <a href=\"https://tailscale.com/docs/features/sharing\">devices shared with you</a> requires using the full domain name.</p>\n<p>You can find the full domain name of any device in your network by opening its page from the <a href=\"https://login.tailscale.com/admin/machines\">Machines</a> page of the admin console.</p>\n<h2><a href=\"https://tailscale.com/docs/features/magicdns#disabling-magicdns\">Disabling MagicDNS</a></h2>\n<p>MagicDNS can be disabled for your whole network by toggling the same button you used to enable it in the <a href=\"https://login.tailscale.com/admin/dns\">DNS</a> page of the admin console.</p>\n<p>If you are experiencing trouble with MagicDNS on a particular device and wish to disable it only there, the current solution is to stop accepting network DNS settings in general.</p>\n<p><strong>On Linux</strong>, stop accepting DNS with:</p>\n<pre><code class=\"language-shell\">tailscale set --accept-dns=false\n</code></pre>\n<p><strong>On macOS</strong>, stop accepting DNS by selecting the Tailscale menu bar icon. From here, select <strong>Preferences</strong>, and then you can uncheck <strong>Use Tailscale DNS settings</strong> from the menu.</p>\n<p><strong>On Windows</strong>, stop accepting DNS by holding <code>SHIFT</code> while right-clicking on the Tailscale system tray icon, and deselecting <strong>Use Tailscale DNS</strong> from the menu.</p>\n<p>In the future, we will have robust enough DNS configuration and resolution logic that disabling MagicDNS separately will never be necessary. At this point, the toggle will disappear.</p>\n<h2><a href=\"https://tailscale.com/docs/features/magicdns#removing-the-betatailscalenet-nameserver\">Removing the <code>beta.tailscale.net</code> nameserver</a></h2>\n<p>Support for the legacy <code>*.beta.tailscale.net</code> nameserver ended on <strong>September 13, 2024</strong>. If you haven't already, migrate your tailnet to use the <a href=\"https://tailscale.com/docs/concepts/tailnet-name#tailnet-dns-name\">tailnet DNS name</a> format nameserver. If you are no longer using the <code>beta.tailscale.net</code> nameserver, you can delete it. Once deleted, you cannot recover it.</p>\n<p>You need to be an <a href=\"https://tailscale.com/docs/reference/user-roles\">Owner, Admin, or IT admin</a> of a tailnet to remove the <code>beta.tailscale.net</code> nameserver.</p>\n<ol>\n<li>Open the <a href=\"https://login.tailscale.com/admin/dns\">DNS</a> page of the admin console.</li>\n<li>Under <strong>Nameservers</strong>, look for the nameserver whose name ends in <code>.beta.tailscale.net</code>, for example, <code>yak-bebop.beta.tailscale.net</code>. (If you don't find a <code>.beta.tailscale.net</code> nameserver, there is nothing to delete.)</li>\n<li>Select the <img src=\"https://tailscale.com/files/images/icons/fa-ellipsis-h.svg\" alt=\"ellipsis icon\"> menu and then select <strong>Delete</strong>.</li>\n<li>Confirm that you want to delete the <code>beta.tailscale.net</code> nameserver and then select <strong>Delete</strong>.</li>\n</ol>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}