diff --git a/clash/config.yaml b/clash/config.yaml
index 71cdd83..ec54fca 100644
--- a/clash/config.yaml
+++ b/clash/config.yaml
@@ -29,6 +29,11 @@ dns:
     - time.nist.gov
     - time.apple.com
     - time.asia.apple.com
+    # Tailscale 必须真实 DNS 解析，否则打洞失败
+    - '*.tailscale.com'
+    - '*.ts.net'
+    - controlplane.tailscale.com
+    - login.tailscale.com
   use-hosts: true
   nameserver:
     - 1.1.1.1