PSA: if your Tailscale box can't resolve anything public, check "Override local DNS"

Spent an evening convinced my VPS had lost its network. SSH was fine (I connect by IP), but apt, curl and anything else that had to resolve a name hung for about 20 seconds and died. It was the tailnet's "Override local DNS" setting. MagicDNS had become the only resolver, with a ~. search domain, so every public lookup went to global nameservers on my home network that the VPS can't reach. The resolvers from eth0 were just ignored. resolvectl status showed it. sudo tailscale set --accept-dns=false fixed it. The cost is no MagicDNS on that box, so I reach tailnet peers by IP now.