Dnsmasq 2.93 (OpenWrt 25.12.5): Tailscale split-DNS broken by new 100.64.0.0/10 rebind protection

Installing and Using OpenWrt
1

After upgrading from OpenWrt 25.12.4 to 25.12.5, Tailscale hostnames (*.ts.net, custom split-DNS zones) stopped resolving.

25.12.5 bumps dnsmasq from 2.91 to 2.93[2] and on mailing list it appears they added CGNAT to private range[1]

When reading logs you will now find lines as

daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: ...ts.net

Fix is to whitelist domains:

uci add_list dhcp.@dnsmasq[0].rebind_domain='ts.net'
uci add_list dhcp.@dnsmasq[0].rebind_domain='example.com'   # any custom split-DNS zone
uci commit dhcp
/etc/init.d/dnsmasq restart

References:

[1] dnsmasq patch: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2025q2/018209.html
[2] OpenWrt 25.12.5 changelog (dnsmasq 2.93): https://openwrt.org/releases/25.12/changelog-25.12.5
[3] Tailscale rebind FAQ: https://tailscale.com/docs/reference/faq/dns-rebinding
[4] OpenWrt UCI rebind_domain: https://openwrt.org/docs/guide-user/base-system/dhcp

2

Thanks for the quick fix for users of tailscale.
But nothing is broken here. The default config of dnsmasq is correct.
If someone chooses to use tailscale of course they need to configure their setup correctly.
And tailscale could just try to avoid to do legacy IP instead of IPv6 ....

3

Thanks for the explanation!

I ran into the same issue and spent quite some time debugging it. Your post finally made it clear what was going on. Thanks for tracking this down and sharing the workaround!