From 934c63115ea7a9ec842f171ea2baa60731105fe8 Mon Sep 17 00:00:00 2001
From: Dmytro Shynkevych <dmytro@tailscale.com>
Date: Tue, 4 Aug 2020 20:13:30 -0400
Subject: [PATCH] ipn: put Magic DNS domains first

Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
---
 ipn/local.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ipn/local.go b/ipn/local.go
index 9f1829dce..0fb250beb 100644
--- a/ipn/local.go
+++ b/ipn/local.go
@@ -939,7 +939,8 @@ func (b *LocalBackend) authReconfig() {
 				b.logf("[unexpected] dns proxied but no nameservers")
 				proxied = false
 			} else {
-				domains = append(domains, domainsForProxying(nm)...)
+				// Domains for proxying should come first to avoid leaking queries.
+				domains = append(domainsForProxying(nm), domains...)
 			}
 		}
 		rcfg.DNS = dns.Config{