The DNS resolver on the Network answers every private name with the address of the ingress. It resolves other names as the public internet does.A WireGuard peer configuration names the resolver once the resolver is provisioned, so a peer requests a private function by name. Devices on a tailnet reach the resolver through a Tailscale Subnet Router and split DNS: see Tailscale.