diff --git a/health/health.go b/health/health.go
index 18464d0f7..aaafdefb2 100644
--- a/health/health.go
+++ b/health/health.go
@@ -64,6 +64,9 @@ const (
 	// SysDNSOS is the name of the net/dns OSConfigurator subsystem.
 	SysDNSOS = Subsystem("dns-os")
 
+	// SysDNSManager is the name of the net/dns manager subsystem.
+	SysDNSManager = Subsystem("dns-manager")
+
 	// SysNetworkCategory is the name of the subsystem that sets
 	// the Windows network adapter's "category" (public, private, domain).
 	// If it's unhealthy, the Windows firewall rules won't match.
@@ -110,6 +113,10 @@ func DNSHealth() error { return get(SysDNS) }
 // SetDNSOSHealth sets the state of the net/dns.OSConfigurator
 func SetDNSOSHealth(err error) { set(SysDNSOS, err) }
 
+// SetDNSManagerHealth sets the state of the Linux net/dns manager's
+// discovery of the /etc/resolv.conf situation.
+func SetDNSManagerHealth(err error) { set(SysDNSManager, err) }
+
 // DNSOSHealth returns the net/dns.OSConfigurator error state.
 func DNSOSHealth() error { return get(SysDNSOS) }
 
diff --git a/net/dns/manager_linux.go b/net/dns/manager_linux.go
index 843abca16..5b91b4155 100644
--- a/net/dns/manager_linux.go
+++ b/net/dns/manager_linux.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/godbus/dbus/v5"
 	"inet.af/netaddr"
+	"tailscale.com/health"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/cmpver"
 )
@@ -216,7 +217,7 @@ func dnsMode(logf logger.Logf, env newOSConfigEnv) (ret string, err error) {
 		}
 		dbg("nm-resolved", "yes")
 
-		if err := env.dbusPing("org.freedesktop.resolve1", "/org/freedesktop/resolve1"); err != nil {
+		if !resolvedUp {
 			dbg("resolved", "no")
 			return "direct", nil
 		}
@@ -241,6 +242,7 @@ func dnsMode(logf logger.Logf, env newOSConfigEnv) (ret string, err error) {
 			dbg("nm-safe", "yes")
 			return "network-manager", nil
 		}
+		health.SetDNSManagerHealth(errors.New("systemd-resolved and NetworkManager are wired together incorrectly; MagicDNS will probably not work. For more info, see https://tailscale.com/s/resolved-nm"))
 		dbg("nm-safe", "no")
 		return "systemd-resolved", nil
 	default: