Comment by aborsy

Part of the reason I let Tailscale up even if I don’t need connectivity is DoH.

It can send DNS in all devices encrypted to a public or private DNS server. It can force this by overriding client configuration if desired.