DNS

Yeet DNS lets services and VMs on svc networking reach each other by name instead of hard-coding private IP addresses. svc networking also gives the workload ordinary outbound internet through the catch host.

DNS here is intentionally narrow. It is not a tailnet-wide naming system and it is not a replacement for your LAN resolver. It resolves names for workloads that joined the yeet service network.

ISO networking uses a separate public-only resolver. It deliberately does not publish Yeet service names.

For services and VMs with a svc network address, yeet answers:

• Short names, such as vaultwarden.
• Fully qualified names under yeet.internal, such as vaultwarden.yeet.internal.

Both forms resolve to the service's svc address.

Examples from another svc service or VM:

http://home-assistant:8123
postgres://postgres:5432/app

Services without svc networking do not get yeet DNS records. Use svc,ts instead of plain ts when a Tailscale-exposed service also needs yeet DNS, private service traffic, or catch-host internet egress. Plain ts is a different network path.

An iso workload can resolve ordinary public names without gaining Yeet or private-network discovery. Its dedicated resolver:

• Does not add a yeet.internal search domain.
• Refuses Yeet-local forward and reverse zones.
• Refuses or removes private, special-purpose, and IPv6 address answers.
• Accepts TCP and UDP DNS only from the assigned ISO source prefixes.

VMs use the Catch side of their private point-to-point link as the resolver. Container components use their project router, which forwards to the same public-only Catch service. Direct DNS to another public server on TCP or UDP port 53 and DNS over TLS on port 853 are rejected. DNS over HTTPS remains indistinguishable from otherwise permitted HTTPS traffic.

An iso,ts container service also gets Tailscale MagicDNS and split DNS through its own Tailscale identity. Plain iso has no tailnet DNS path.

The resolver listens on the service-network gateway:

192.168.100.1:53

Check it directly:

dig @192.168.100.1 web A +short
dig @192.168.100.1 web.yeet.internal A +short

Yeet forwards ordinary external names through the catch host's resolver. It forwards tailnet names under *.ts.net to Tailscale DNS. In other words, the service network gets useful names without becoming the only resolver in the room.

Compose services using --net=svc get yeet DNS automatically. Application code can normally use short service names.

yeet run uptime-kuma ./compose.yml --net=svc

If a Compose file already sets dns: or dns_search:, those settings remain under the service's control.

VMs use svc networking by default, so new VMs get yeet DNS automatically.

yeet run lab-vm vm://ubuntu/26.04
yeet ssh lab-vm

From inside the VM, other svc services and VMs resolve by short name and *.yeet.internal name.

For VMs with both svc and lan, yeet keeps the svc resolver scoped to yeet names so LAN-provided DNS can still handle normal external names.

Use simple service names:

• Lowercase letters, digits, and hyphens.
• Starts and ends with a letter or digit.
• One label for the short form.

Names resolve case-insensitively, but lowercase names are easier to read and copy.

Confirm the service uses svc networking:

yeet info <svc>
yeet ip <svc>

Query the resolver:

dig @192.168.100.1 <svc> A +short
dig @192.168.100.1 <svc>.yeet.internal A +short

If the query returns nothing, the service probably does not have a svc network address yet. Redeploy or update the service networking, then check again. The resolver cannot publish a service that never joined its network.

See Networking for mode selection.