Learn Tailscale - Tailnet & MagicDNS

#Introduction

In episode 4 you connected many devices and verified them. The natural next question: how do you remember the addresses of all those devices? Memorizing 100.x.x.x IPs for dozens of nodes is a nightmare. This is where MagicDNS and the tailnet concept come in.

Episode 5 covers two things often confused with each other even though they're different: the tailnet as a network identity, and MagicDNS as the naming system that makes devices easy to reach. You'll learn the full hostname format node.tailnet-name.ts.net, understand why Tailscale IP addresses live in the CGNAT range 100.64.0.0/10, and how to name and find devices.

#The Tailnet Concept

#Your Network Identity

A tailnet is a private network owned by one organization — it can be a personal account or many users managed by an admin. Every tailnet has a unique name visible in the admin console and used as the MagicDNS domain. Example tailnet names: devnull or my-company.

tailscale status
tailscale whois $(tailscale ip -4)

The easiest way to see your tailnet name: the full MagicDNS hostname in tailscale status always ends in .ts.net.

#100.x.x.x IP Addresses: The CGNAT Range

Every node in the tailnet gets an IP address from the CGNAT range 100.64.0.0/10. This range is specifically reserved for ISP use, so it doesn't collide with local 192.168.x.x addresses or public ones. That's why all Tailscale nodes use addresses that look like 100.100.x.x or 100.101.x.x.

tailscale ip
tailscale ip -4

The tailscale ip -4 command shows your tailnet IPv4 address — example output: 100.101.102.103. This address stays stable as long as the node is registered, and it's what all inter-node connections use.

#MagicDNS: Automatic Naming

#Full .ts.net Hostnames

MagicDNS gives every node a full hostname of the form <name>.<tailnet-name>.ts.net. So if the tailnet is named devnull and the node is named aws-1, the full hostname is aws-1.devnull.ts.net. You can use this name directly in SSH, the browser, or curl:

ssh devnull@aws-1.devnull.ts.net
curl http://nas-home.devnull.ts.net

The full hostname <name>.<tailnet-name>.ts.net can always be resolved from any device in the tailnet — as long as MagicDNS is enabled (the default).

#Short Hostname Resolution

Besides the full name, MagicDNS also resolves short hostnames. You can just write aws-1 without the full domain:

ping aws-1
ssh devnull@aws-1

This convenience makes everyday commands much shorter — just the node name, not an IP address or long name.

#Checking DNS Configuration

tailscale dns

The output shows the tailnet name, whether MagicDNS is active, and the search domain in use. If MagicDNS isn't active, enable it from the admin console or set it via the CLI (full details in episode 10).

#Naming and Discovery

#Naming Devices

The default hostname is taken from the operating system, and is often not descriptive, like DESKTOP-A1B2C3. When connecting, set a clear name:

sudo tailscale up --hostname=server-home

After up, the node is reachable as server-home (short) and server-home.<tailnet-name>.ts.net (full). Suggested convention: combine role and location, e.g. web-prod, db-aws, nas-home.

#Finding Other Devices

Two ways to find nodes in the tailnet:

• tailscale status: lists all nodes with names, IPs, and status.
• tailscale status --peers: lists only other nodes (not yourself).

tailscale status --peers

With a combination of clean naming and MagicDNS, finding devices is as easy as reading a list.

#Naming Best Practices

#Rules Worth Following

• Use lowercase letters, numbers, and hyphens.
• Avoid spaces and special characters.
• Be consistent with the role: vpn, nas, worker-01.
• Devices move between networks — the hostname doesn't change, and the tailnet IP stays stable.

#Renaming After Connect

Names can be changed at any time from the admin console (device menu, Edit name). The change is immediately visible in MagicDNS without needing a restart.

#Summary

The tailnet gives you network identity; MagicDNS gives you an easy way to use it. With an understanding of the CGNAT range, the hostname format, short hostnames, and good naming, navigating the tailnet becomes fast and pleasant.

#Closing

Episode 5 brought together the tailnet and MagicDNS concepts: you know why the IPs are 100.x.x.x, what the node.tailnet-name.ts.net hostname format looks like, how to use short hostnames, and clean naming practices.

Key takeaways:

• A tailnet is a private network identity owned by one organization.
• Tailscale IPs live in the CGNAT range 100.64.0.0/10.
• MagicDNS provides the <name>.<tailnet-name>.ts.net hostname.
• Short hostnames can be used without the full domain.
• tailscale up --hostname=... and tailscale dns for naming and checking.
• Consistent naming conventions keep even large tailnets easy to navigate.

In the next episode, episode 6, we'll cover access control: ACLs and tags — the Access Control Lists concept in the admin console, allow/deny rules, a basic policy example, assigning tags to devices, and grouping users for managed policies.