diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index d91a960c4..aa73cff93 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -91,6 +91,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/logtail/filch                                  from tailscale.com/logpolicy
         tailscale.com/metrics                                        from tailscale.com/derp
         tailscale.com/net/dns                                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/dns/resolver                               from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/dnscache                                   from tailscale.com/control/controlclient+
         tailscale.com/net/dnsfallback                                from tailscale.com/control/controlclient
         tailscale.com/net/flowtrack                                  from tailscale.com/wgengine/filter+
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 0ba0b067c..e04df3f4e 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -28,6 +28,7 @@ import (
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/ipn/policy"
 	"tailscale.com/net/dns"
+	"tailscale.com/net/dns/resolver"
 	"tailscale.com/net/interfaces"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/paths"
@@ -871,7 +872,7 @@ func (b *LocalBackend) updateDNSMap(netMap *netmap.NetworkMap) {
 	}
 	set(netMap.Name, netMap.Addresses)
 
-	dnsMap := dns.NewMap(nameToIP, magicDNSRootDomains(netMap))
+	dnsMap := resolver.NewMap(nameToIP, magicDNSRootDomains(netMap))
 	// map diff will be logged in dns.Resolver.SetMap.
 	b.e.SetDNSMap(dnsMap)
 }
diff --git a/net/dns/forwarder.go b/net/dns/resolver/forwarder.go
similarity index 99%
rename from net/dns/forwarder.go
rename to net/dns/resolver/forwarder.go
index 519c00027..50a1bd009 100644
--- a/net/dns/forwarder.go
+++ b/net/dns/resolver/forwarder.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package dns
+package resolver
 
 import (
 	"bytes"
diff --git a/net/dns/map.go b/net/dns/resolver/map.go
similarity index 99%
rename from net/dns/map.go
rename to net/dns/resolver/map.go
index 119b6cc0a..c73aef9a8 100644
--- a/net/dns/map.go
+++ b/net/dns/resolver/map.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package dns
+package resolver
 
 import (
 	"sort"
diff --git a/net/dns/map_test.go b/net/dns/resolver/map_test.go
similarity index 99%
rename from net/dns/map_test.go
rename to net/dns/resolver/map_test.go
index c438f95a0..784240ae7 100644
--- a/net/dns/map_test.go
+++ b/net/dns/resolver/map_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package dns
+package resolver
 
 import (
 	"fmt"
diff --git a/net/dns/neterr_darwin.go b/net/dns/resolver/neterr_darwin.go
similarity index 97%
rename from net/dns/neterr_darwin.go
rename to net/dns/resolver/neterr_darwin.go
index 7fd621fc7..b1954648c 100644
--- a/net/dns/neterr_darwin.go
+++ b/net/dns/resolver/neterr_darwin.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package dns
+package resolver
 
 import (
 	"errors"
diff --git a/net/dns/neterr_other.go b/net/dns/resolver/neterr_other.go
similarity index 94%
rename from net/dns/neterr_other.go
rename to net/dns/resolver/neterr_other.go
index b652f6e8b..df802dcfb 100644
--- a/net/dns/neterr_other.go
+++ b/net/dns/resolver/neterr_other.go
@@ -4,7 +4,7 @@
 
 // +build !darwin,!windows
 
-package dns
+package resolver
 
 func networkIsDown(err error) bool        { return false }
 func networkIsUnreachable(err error) bool { return false }
diff --git a/net/dns/neterr_windows.go b/net/dns/resolver/neterr_windows.go
similarity index 97%
rename from net/dns/neterr_windows.go
rename to net/dns/resolver/neterr_windows.go
index 2b197ee2b..043d19477 100644
--- a/net/dns/neterr_windows.go
+++ b/net/dns/resolver/neterr_windows.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package dns
+package resolver
 
 import (
 	"net"
diff --git a/net/dns/tsdns.go b/net/dns/resolver/tsdns.go
similarity index 98%
rename from net/dns/tsdns.go
rename to net/dns/resolver/tsdns.go
index 2b530b81e..418c4ac7d 100644
--- a/net/dns/tsdns.go
+++ b/net/dns/resolver/tsdns.go
@@ -2,9 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package dns provides a Resolver capable of resolving
-// domains on a Tailscale network.
-package dns
+// Package resolver a DNS resolver.
+package resolver
 
 import (
 	"encoding/hex"
@@ -96,9 +95,9 @@ type ResolverConfig struct {
 	LinkMonitor *monitor.Mon
 }
 
-// NewResolver constructs a resolver associated with the given root domain.
+// New constructs a resolver associated with the given root domain.
 // The root domain must be in canonical form (with a trailing period).
-func NewResolver(config ResolverConfig) *Resolver {
+func New(config ResolverConfig) *Resolver {
 	r := &Resolver{
 		logf:      logger.WithPrefix(config.Logf, "dns: "),
 		linkMon:   config.LinkMonitor,
diff --git a/net/dns/tsdns_server_test.go b/net/dns/resolver/tsdns_server_test.go
similarity index 99%
rename from net/dns/tsdns_server_test.go
rename to net/dns/resolver/tsdns_server_test.go
index 95544ba18..5c0ff1325 100644
--- a/net/dns/tsdns_server_test.go
+++ b/net/dns/resolver/tsdns_server_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package dns
+package resolver
 
 import (
 	"log"
diff --git a/net/dns/tsdns_test.go b/net/dns/resolver/tsdns_test.go
similarity index 97%
rename from net/dns/tsdns_test.go
rename to net/dns/resolver/tsdns_test.go
index 59bcd8ec1..1fef7b010 100644
--- a/net/dns/tsdns_test.go
+++ b/net/dns/resolver/tsdns_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package dns
+package resolver
 
 import (
 	"bytes"
@@ -194,7 +194,7 @@ func TestRDNSNameToIPv6(t *testing.T) {
 }
 
 func TestResolve(t *testing.T) {
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: false})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: false})
 	r.SetMap(dnsMap)
 
 	if err := r.Start(); err != nil {
@@ -240,7 +240,7 @@ func TestResolve(t *testing.T) {
 }
 
 func TestResolveReverse(t *testing.T) {
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: false})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: false})
 	r.SetMap(dnsMap)
 
 	if err := r.Start(); err != nil {
@@ -318,7 +318,7 @@ func TestDelegate(t *testing.T) {
 		return
 	}
 
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: true})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: true})
 	r.SetMap(dnsMap)
 	r.SetUpstreams([]net.Addr{
 		v4server.PacketConn.LocalAddr(),
@@ -397,7 +397,7 @@ func TestDelegateCollision(t *testing.T) {
 	}
 	defer server.Shutdown()
 
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: true})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: true})
 	r.SetMap(dnsMap)
 	r.SetUpstreams([]net.Addr{server.PacketConn.LocalAddr()})
 
@@ -463,7 +463,7 @@ func TestDelegateCollision(t *testing.T) {
 }
 
 func TestConcurrentSetMap(t *testing.T) {
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: false})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: false})
 
 	if err := r.Start(); err != nil {
 		t.Fatalf("start: %v", err)
@@ -499,7 +499,7 @@ func TestConcurrentSetUpstreams(t *testing.T) {
 	}
 	defer server.Shutdown()
 
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: true})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: true})
 	r.SetMap(dnsMap)
 
 	if err := r.Start(); err != nil {
@@ -670,7 +670,7 @@ var emptyResponse = []byte{
 }
 
 func TestFull(t *testing.T) {
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: false})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: false})
 	r.SetMap(dnsMap)
 
 	if err := r.Start(); err != nil {
@@ -709,7 +709,7 @@ func TestFull(t *testing.T) {
 }
 
 func TestAllocs(t *testing.T) {
-	r := NewResolver(ResolverConfig{Logf: t.Logf, Forward: false})
+	r := New(ResolverConfig{Logf: t.Logf, Forward: false})
 	r.SetMap(dnsMap)
 
 	if err := r.Start(); err != nil {
@@ -778,7 +778,7 @@ func BenchmarkFull(b *testing.B) {
 	}
 	defer server.Shutdown()
 
-	r := NewResolver(ResolverConfig{Logf: b.Logf, Forward: true})
+	r := New(ResolverConfig{Logf: b.Logf, Forward: true})
 	r.SetMap(dnsMap)
 	r.SetUpstreams([]net.Addr{server.PacketConn.LocalAddr()})
 
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index 4b03c9bb9..a5370bec6 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -29,7 +29,7 @@ import (
 	"tailscale.com/health"
 	"tailscale.com/internal/deepprint"
 	"tailscale.com/ipn/ipnstate"
-	"tailscale.com/net/dns"
+	"tailscale.com/net/dns/resolver"
 	"tailscale.com/net/flowtrack"
 	"tailscale.com/net/interfaces"
 	"tailscale.com/net/packet"
@@ -83,7 +83,7 @@ type userspaceEngine struct {
 	tundev            *tstun.Wrapper
 	wgdev             *device.Device
 	router            router.Router
-	resolver          *dns.Resolver
+	resolver          *resolver.Resolver
 	magicConn         *magicsock.Conn
 	linkMon           *monitor.Mon
 	linkMonOwned      bool   // whether we created linkMon (and thus need to close it)
@@ -219,7 +219,7 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 		e.linkMonOwned = true
 	}
 
-	e.resolver = dns.NewResolver(dns.ResolverConfig{
+	e.resolver = resolver.New(resolver.ResolverConfig{
 		Logf:        logf,
 		Forward:     true,
 		LinkMonitor: e.linkMon,
@@ -435,7 +435,7 @@ func (e *userspaceEngine) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper)
 // handleDNS is an outbound pre-filter resolving Tailscale domains.
 func (e *userspaceEngine) handleDNS(p *packet.Parsed, t *tstun.Wrapper) filter.Response {
 	if p.Dst.IP == magicDNSIP && p.Dst.Port == magicDNSPort && p.IPProto == ipproto.UDP {
-		request := dns.Packet{
+		request := resolver.Packet{
 			Payload: append([]byte(nil), p.Payload()...),
 			Addr:    netaddr.IPPort{IP: p.Src.IP, Port: p.Src.Port},
 		}
@@ -452,7 +452,7 @@ func (e *userspaceEngine) handleDNS(p *packet.Parsed, t *tstun.Wrapper) filter.R
 func (e *userspaceEngine) pollResolver() {
 	for {
 		resp, err := e.resolver.NextResponse()
-		if err == dns.ErrClosed {
+		if err == resolver.ErrClosed {
 			return
 		}
 		if err != nil {
@@ -1024,7 +1024,7 @@ func (e *userspaceEngine) SetFilter(filt *filter.Filter) {
 	e.tundev.SetFilter(filt)
 }
 
-func (e *userspaceEngine) SetDNSMap(dm *dns.Map) {
+func (e *userspaceEngine) SetDNSMap(dm *resolver.Map) {
 	e.resolver.SetMap(dm)
 }
 
diff --git a/wgengine/watchdog.go b/wgengine/watchdog.go
index 460e8fffe..28b82161c 100644
--- a/wgengine/watchdog.go
+++ b/wgengine/watchdog.go
@@ -14,7 +14,7 @@ import (
 
 	"inet.af/netaddr"
 	"tailscale.com/ipn/ipnstate"
-	"tailscale.com/net/dns"
+	"tailscale.com/net/dns/resolver"
 	"tailscale.com/net/tstun"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/netmap"
@@ -86,7 +86,7 @@ func (e *watchdogEngine) GetFilter() *filter.Filter {
 func (e *watchdogEngine) SetFilter(filt *filter.Filter) {
 	e.watchdog("SetFilter", func() { e.wrap.SetFilter(filt) })
 }
-func (e *watchdogEngine) SetDNSMap(dm *dns.Map) {
+func (e *watchdogEngine) SetDNSMap(dm *resolver.Map) {
 	e.watchdog("SetDNSMap", func() { e.wrap.SetDNSMap(dm) })
 }
 func (e *watchdogEngine) SetStatusCallback(cb StatusCallback) {
diff --git a/wgengine/wgengine.go b/wgengine/wgengine.go
index 5946e1e77..89286ce10 100644
--- a/wgengine/wgengine.go
+++ b/wgengine/wgengine.go
@@ -9,7 +9,7 @@ import (
 
 	"inet.af/netaddr"
 	"tailscale.com/ipn/ipnstate"
-	"tailscale.com/net/dns"
+	"tailscale.com/net/dns/resolver"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/netmap"
 	"tailscale.com/wgengine/filter"
@@ -66,7 +66,7 @@ type Engine interface {
 	SetFilter(*filter.Filter)
 
 	// SetDNSMap updates the DNS map.
-	SetDNSMap(*dns.Map)
+	SetDNSMap(*resolver.Map)
 
 	// SetStatusCallback sets the function to call when the
 	// WireGuard status changes.