diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index a1209761f..d5886960d 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -1392,7 +1392,7 @@ func ipInPrefixes(ip netaddr.IP, pp []netaddr.IPPrefix) bool {
 func dnsIPsOverTailscale(dnsCfg *dns.Config, routerCfg *router.Config) (ret []netaddr.IPPrefix) {
 	m := map[netaddr.IP]bool{}
 
-	for _, resolvers := range dnsCfg.Routes {
+	add := func(resolvers []netaddr.IPPort) {
 		for _, resolver := range resolvers {
 			ip := resolver.IP()
 			if ipInPrefixes(ip, routerCfg.Routes) && !ipInPrefixes(ip, routerCfg.LocalRoutes) {
@@ -1401,6 +1401,11 @@ func dnsIPsOverTailscale(dnsCfg *dns.Config, routerCfg *router.Config) (ret []ne
 		}
 	}
 
+	add(dnsCfg.DefaultResolvers)
+	for _, resolvers := range dnsCfg.Routes {
+		add(resolvers)
+	}
+
 	ret = make([]netaddr.IPPrefix, 0, len(m))
 	for ip := range m {
 		ret = append(ret, netaddr.IPPrefixFrom(ip, ip.BitLen()))