diff --git a/net/dns/manager_linux.go b/net/dns/manager_linux.go
index bbbb013b8..326f08590 100644
--- a/net/dns/manager_linux.go
+++ b/net/dns/manager_linux.go
@@ -112,10 +112,6 @@ func dnsMode(logf logger.Logf, env newOSConfigEnv) (ret string, err error) {
 			dbg("resolved", "not-in-use")
 			return "direct", nil
 		}
-		if !resolvedUp {
-			dbg("resolved", "no")
-			return "direct", nil
-		}
 		if err := env.dbusPing("org.freedesktop.NetworkManager", "/org/freedesktop/NetworkManager/DnsManager"); err != nil {
 			dbg("nm", "no")
 			return "systemd-resolved", nil
@@ -217,11 +213,6 @@ func dnsMode(logf logger.Logf, env newOSConfigEnv) (ret string, err error) {
 		}
 		dbg("nm-resolved", "yes")
 
-		if !resolvedUp {
-			dbg("resolved", "no")
-			return "direct", nil
-		}
-
 		// See large comment above for reasons we'd use NM rather than
 		// resolved. systemd-resolved is actually in charge of DNS
 		// configuration, but in some cases we might need to configure
diff --git a/net/dns/manager_linux_test.go b/net/dns/manager_linux_test.go
index 1826b76d9..2e609d121 100644
--- a/net/dns/manager_linux_test.go
+++ b/net/dns/manager_linux_test.go
@@ -69,13 +69,13 @@ func TestLinuxDNSMode(t *testing.T) {
 			want:    "direct",
 		},
 		{
-			name:    "resolved_not_running",
+			name:    "resolved_alone_without_ping",
 			env:     env(resolvDotConf("# Managed by systemd-resolved", "nameserver 127.0.0.53")),
-			wantLog: "dns: [rc=resolved resolved=no ret=direct]",
-			want:    "direct",
+			wantLog: "dns: [rc=resolved nm=no ret=systemd-resolved]",
+			want:    "systemd-resolved",
 		},
 		{
-			name: "resolved_alone",
+			name: "resolved_alone_with_ping",
 			env: env(
 				resolvDotConf("# Managed by systemd-resolved", "nameserver 127.0.0.53"),
 				resolvedRunning()),
@@ -162,17 +162,17 @@ func TestLinuxDNSMode(t *testing.T) {
 		{
 			// More than one user has had resolvconf write a config that points to
 			// systemd-resolved. We're better off using systemd-resolved.
-			// ...but what if systemd-resolved isn't running?
+			// and assuming that even if the ping doesn't show that env is correct
 			// regression test for https://github.com/tailscale/tailscale/issues/3026
-			name: "allegedly_resolvconf_but_actually_systemd-resolved_but_not_really",
+			name: "allegedly_resolvconf_but_actually_systemd-resolved_but_no_ping",
 			env: env(resolvDotConf(
 				"# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)",
 				"#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN",
 				"# 127.0.0.53 is the systemd-resolved stub resolver.",
 				"# run \"systemd-resolve --status\" to see details about the actual nameservers.",
 				"nameserver 127.0.0.53")),
-			wantLog: "dns: [rc=resolved resolved=no ret=direct]",
-			want:    "direct",
+			wantLog: "dns: [rc=resolved nm=no ret=systemd-resolved]",
+			want:    "systemd-resolved",
 		},
 		{
 			// regression test for https://github.com/tailscale/tailscale/issues/3304
@@ -188,14 +188,14 @@ func TestLinuxDNSMode(t *testing.T) {
 		},
 		{
 			// regression test for https://github.com/tailscale/tailscale/issues/3304
-			name: "networkmanager_but_pointing_at_systemd-resolved_but_no_resolved",
+			name: "networkmanager_but_pointing_at_systemd-resolved_but_no_resolved_ping",
 			env: env(resolvDotConf(
 				"# Generated by NetworkManager",
 				"nameserver 127.0.0.53",
 				"options edns0 trust-ad"),
 				nmRunning("1.32.12", true)),
-			wantLog: "dns: [rc=nm nm-resolved=yes resolved=no ret=direct]",
-			want:    "direct",
+			wantLog: "dns: [rc=nm nm-resolved=yes nm-safe=no ret=systemd-resolved]",
+			want:    "systemd-resolved",
 		},
 		{
 			// regression test for https://github.com/tailscale/tailscale/issues/3304