diff --git a/internal/deepprint/deepprint_test.go b/internal/deepprint/deepprint_test.go
index 043562eea..c7e2031f2 100644
--- a/internal/deepprint/deepprint_test.go
+++ b/internal/deepprint/deepprint_test.go
@@ -9,8 +9,8 @@ import (
 	"testing"
 
 	"inet.af/netaddr"
-	"tailscale.com/wgengine/router"
 	"tailscale.com/net/dns"
+	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
 )
 
diff --git a/wgengine/router/router.go b/wgengine/router/router.go
index 3d8bf1574..5f459c6d6 100644
--- a/wgengine/router/router.go
+++ b/wgengine/router/router.go
@@ -10,9 +10,9 @@ import (
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
 	"inet.af/netaddr"
+	"tailscale.com/net/dns"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/preftype"
-	"tailscale.com/net/dns"
 )
 
 // Router is responsible for managing the system network stack.
diff --git a/wgengine/router/router_linux.go b/wgengine/router/router_linux.go
index 3d9dfcf41..081f7c434 100644
--- a/wgengine/router/router_linux.go
+++ b/wgengine/router/router_linux.go
@@ -19,11 +19,11 @@ import (
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
 	"inet.af/netaddr"
+	"tailscale.com/net/dns"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/preftype"
 	"tailscale.com/version/distro"
-	"tailscale.com/net/dns"
 )
 
 const (
diff --git a/wgengine/router/router_openbsd.go b/wgengine/router/router_openbsd.go
index aecf42496..9b5d38471 100644
--- a/wgengine/router/router_openbsd.go
+++ b/wgengine/router/router_openbsd.go
@@ -13,8 +13,8 @@ import (
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
 	"inet.af/netaddr"
-	"tailscale.com/types/logger"
 	"tailscale.com/net/dns"
+	"tailscale.com/types/logger"
 )
 
 // For now this router only supports the WireGuard userspace implementation.
diff --git a/wgengine/router/router_userspace_bsd.go b/wgengine/router/router_userspace_bsd.go
index f89a3e5f1..494a1d51c 100644
--- a/wgengine/router/router_userspace_bsd.go
+++ b/wgengine/router/router_userspace_bsd.go
@@ -15,9 +15,9 @@ import (
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
 	"inet.af/netaddr"
+	"tailscale.com/net/dns"
 	"tailscale.com/types/logger"
 	"tailscale.com/version"
-	"tailscale.com/net/dns"
 )
 
 type userspaceBSDRouter struct {
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index ab4d9f78b..b5a4ca832 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -30,6 +30,7 @@ import (
 	"tailscale.com/health"
 	"tailscale.com/internal/deepprint"
 	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/net/dns"
 	"tailscale.com/net/flowtrack"
 	"tailscale.com/net/interfaces"
 	"tailscale.com/net/packet"
@@ -47,7 +48,6 @@ import (
 	"tailscale.com/wgengine/magicsock"
 	"tailscale.com/wgengine/monitor"
 	"tailscale.com/wgengine/router"
-	"tailscale.com/net/dns"
 	"tailscale.com/wgengine/tstun"
 	"tailscale.com/wgengine/wgcfg"
 	"tailscale.com/wgengine/wglog"
diff --git a/wgengine/watchdog.go b/wgengine/watchdog.go
index bc83044ca..f3248d6fc 100644
--- a/wgengine/watchdog.go
+++ b/wgengine/watchdog.go
@@ -14,12 +14,12 @@ import (
 
 	"inet.af/netaddr"
 	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/net/dns"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/netmap"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/monitor"
 	"tailscale.com/wgengine/router"
-	"tailscale.com/net/dns"
 	"tailscale.com/wgengine/wgcfg"
 )
 
diff --git a/wgengine/wgengine.go b/wgengine/wgengine.go
index efb2b34d5..5946e1e77 100644
--- a/wgengine/wgengine.go
+++ b/wgengine/wgengine.go
@@ -9,12 +9,12 @@ import (
 
 	"inet.af/netaddr"
 	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/net/dns"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/netmap"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/monitor"
 	"tailscale.com/wgengine/router"
-	"tailscale.com/net/dns"
 	"tailscale.com/wgengine/wgcfg"
 )