DNS Leaks with VPN Exit Nodes: What Tailscale Users Need to Know

The Privacy Promise of VPN Exit Nodes

When you route your traffic through a VPN exit node, you're trusting that your DNS queries will travel through the encrypted tunnel along with your other traffic. This is the whole point—hiding your browsing activity from your ISP and local network observers.

But what happens when your DNS queries leak outside the tunnel?

That's exactly what users are reporting with Tailscale's Mullvad integration.

Understanding DNS Leaks

DNS (Domain Name System) is essentially the internet's phone book. When you type "example.com," your computer asks a DNS server to translate that into an IP address. Normally, this query goes through your ISP's DNS servers by default, which means they can see every website you attempt to visit—even if the actual connection is encrypted.

A VPN's job is to intercept these DNS queries and route them through the encrypted tunnel, so only the VPN provider sees your DNS traffic. When a "DNS leak" occurs, your DNS queries bypass this protection entirely, exposing your browsing habits to your ISP or local network.

The Tailscale + Mullvad Issue

According to a reported bug (Issue #9284 on the Tailscale GitHub repository), users subscribed to Mullvad's optional exit node service through Tailscale are experiencing DNS leaks. The issue appears across multiple platforms: macOS, Windows, and iOS, using Tailscale version 1.48.2.

The verification is straightforward—users can visit browser leak test sites to confirm whether their DNS queries are properly tunneled or leaking to their default ISP resolvers.

Why This Matters for Developers and Startups

If you're using Tailscale to create a secure network for your team or to protect sensitive development work, DNS leaks can undermine your security posture in subtle but significant ways:

• Compliance concerns: HIPAA, SOC 2, and other frameworks often require traffic isolation that leaks can compromise
• Security auditing: Penetration testers and security scanners may flag unexpected DNS queries
• Privacy for technical work: Developer tools and internal services can reveal sensitive project information through DNS queries

What You Can Do Right Now

1. Test your setup: Visit https://browserleaks.com/dns and verify which DNS server is resolving your queries

2. Check for platform-specific issues: The bug report indicates platform-specific behavior, so test from multiple devices

3. Monitor Tailscale's updates: Bug fixes for issues like this typically arrive in subsequent releases

4. Consider fallback configurations: If DNS protection is critical for your use case, verify your Tailscale exit node configuration matches your security requirements

The Bigger Picture

This situation highlights an important truth about privacy tools: they're only as strong as their implementation. A VPN provider's reputation means little if the integration layer introduces vulnerabilities.

For teams evaluating Tailscale or Mullvad for production use cases, this is a reminder that security configurations should be tested regularly, not just at setup time. DNS leak tests should be part of your standard security audit checklist alongside port scans and traffic analysis.

We'll continue monitoring this issue and will update our readers when a fix is officially released. In the meantime, verify your tunnel is actually protecting your DNS queries—it might not be doing what you think.