diff --git a/derp/derpmap/derpmap.go b/derp/derpmap/derpmap.go
index 8ba4a248b..e0c55eb4b 100644
--- a/derp/derpmap/derpmap.go
+++ b/derp/derpmap/derpmap.go
@@ -7,6 +7,7 @@ package derpmap
 
 import (
 	"fmt"
+	"net"
 
 	"tailscale.com/types/structs"
 )
@@ -43,6 +44,13 @@ func (w *World) NodeIDOfSTUNServer(server string) int {
 	return 0
 }
 
+// ForeachServer calls fn for each DERP server, in an unspecified order.
+func (w *World) ForeachServer(fn func(*Server)) {
+	for _, s := range w.byID {
+		fn(s)
+	}
+}
+
 // Prod returns the production DERP nodes.
 func Prod() *World {
 	return prod
@@ -95,9 +103,15 @@ func (w *World) add(s *Server) {
 	w.servers = append(w.servers, s)
 	if s.STUN4 != "" {
 		w.stun4 = append(w.stun4, s.STUN4)
+		if _, _, err := net.SplitHostPort(s.STUN4); err != nil {
+			panic("not a host:port: " + s.STUN4)
+		}
 	}
 	if s.STUN6 != "" {
 		w.stun6 = append(w.stun6, s.STUN6)
+		if _, _, err := net.SplitHostPort(s.STUN6); err != nil {
+			panic("not a host:port: " + s.STUN6)
+		}
 	}
 }
 
diff --git a/netcheck/netcheck_test.go b/netcheck/netcheck_test.go
index 4eacd448f..110ace79a 100644
--- a/netcheck/netcheck_test.go
+++ b/netcheck/netcheck_test.go
@@ -102,22 +102,22 @@ func TestAddReportHistoryAndSetPreferredDERP(t *testing.T) {
 	derps := derpmap.NewTestWorldWith(
 		&derpmap.Server{
 			ID:    1,
-			STUN4: "d1",
+			STUN4: "d1:1",
 		},
 		&derpmap.Server{
 			ID:    2,
-			STUN4: "d2",
+			STUN4: "d2:1",
 		},
 		&derpmap.Server{
 			ID:    3,
-			STUN4: "d3",
+			STUN4: "d3:1",
 		},
 	)
 	// report returns a *Report from (DERP host, time.Duration)+ pairs.
 	report := func(a ...interface{}) *Report {
 		r := &Report{DERPLatency: map[string]time.Duration{}}
 		for i := 0; i < len(a); i += 2 {
-			k := a[i].(string)
+			k := a[i].(string) + ":1"
 			switch v := a[i+1].(type) {
 			case time.Duration:
 				r.DERPLatency[k] = v