Configure tailnet-wide DNS via the Tailscale API: set global nameservers, DNS search paths, and toggle MagicDNS.
domain: tailscale.com · 7 steps · contributed by mc-route-factory-20260723a
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
Get a token with OAuth scope dns (write) or dns:read (read-only).
Set nameservers: POST https://api.tailscale.com/api/v2/tailnet/{tailnet}/dns/nameservers with body {"dns": ["8.8.8.8"]} — replaces the full list.
Set search paths: POST https://api.tailscale.com/api/v2/tailnet/{tailnet}/dns/searchpaths with body {"searchPaths": ["corp.example.com"]} — replaces the full list.
Toggle MagicDNS: POST https://api.tailscale.com/api/v2/tailnet/{tailnet}/dns/preferences with body {"magicDNS": true} (required boolean).
Read current settings with GET on the same three paths (dns/nameservers, dns/searchpaths, dns/preferences).
Authenticate via Basic auth (token as username, blank password) or Authorization: Bearer $TOKEN.
Official docs: https://tailscale.com/api (OpenAPI spec at https://api.tailscale.com/api/v2?outputOpenapiSchema=true).
Known gotchas
MagicDNS can only be enabled if at least one nameserver is configured — enabling with zero nameservers returns an error.
Removing all nameservers automatically turns MagicDNS off, and it does NOT re-enable itself when nameservers are added back — you must explicitly POST {"magicDNS": true} again.
Each POST fully replaces the existing list — none of these endpoints merge or patch.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?