diff --git a/cmd/tailscaled/tailscaled.go b/cmd/tailscaled/tailscaled.go
index 2fde8c803..db2f37a6a 100644
--- a/cmd/tailscaled/tailscaled.go
+++ b/cmd/tailscaled/tailscaled.go
@@ -31,6 +31,7 @@ import (
 	"github.com/go-multierror/multierror"
 	"tailscale.com/ipn/ipnserver"
 	"tailscale.com/logpolicy"
+	"tailscale.com/net/dns"
 	"tailscale.com/net/socks5"
 	"tailscale.com/net/tstun"
 	"tailscale.com/paths"
@@ -192,6 +193,7 @@ func run() error {
 	logf = logger.RateLimitedFn(logf, 5*time.Second, 5, 100)
 
 	if args.cleanup {
+		dns.Cleanup(logf, args.tunname)
 		router.Cleanup(logf, args.tunname)
 		return nil
 	}
diff --git a/net/dns/manager.go b/net/dns/manager.go
index 8e2fc9d71..3c0ca6838 100644
--- a/net/dns/manager.go
+++ b/net/dns/manager.go
@@ -98,3 +98,18 @@ func (m *Manager) Up() error {
 func (m *Manager) Down() error {
 	return m.impl.Down()
 }
+
+// Cleanup restores the system DNS configuration to its original state
+// in case the Tailscale daemon terminated without closing the router.
+// No other state needs to be instantiated before this runs.
+func Cleanup(logf logger.Logf, interfaceName string) {
+	mconfig := ManagerConfig{
+		Logf:          logf,
+		InterfaceName: interfaceName,
+		Cleanup:       true,
+	}
+	dns := NewManager(mconfig)
+	if err := dns.Down(); err != nil {
+		logf("dns down: %v", err)
+	}
+}
diff --git a/wgengine/router/router.go b/wgengine/router/router.go
index 1a8e43714..e164ef13b 100644
--- a/wgengine/router/router.go
+++ b/wgengine/router/router.go
@@ -41,15 +41,6 @@ func New(logf logger.Logf, tundev tun.Device) (Router, error) {
 // in case the Tailscale daemon terminated without closing the router.
 // No other state needs to be instantiated before this runs.
 func Cleanup(logf logger.Logf, interfaceName string) {
-	mconfig := dns.ManagerConfig{
-		Logf:          logf,
-		InterfaceName: interfaceName,
-		Cleanup:       true,
-	}
-	dns := dns.NewManager(mconfig)
-	if err := dns.Down(); err != nil {
-		logf("dns down: %v", err)
-	}
 	cleanup(logf, interfaceName)
 }