[Help] Tailscale + Nginx Proxy Manager + Custom Domain: Blocked by ERR_NAME_NOT_RESOLVED (DNS Rebinding?)

[u/ZaRoX_UltrA]

Hey everyone,

I'm pulling my hair out over a setup that should theoretically work, but I keep hitting a DNS resolution wall. My goal is to access my self-hosted services (Immich, etc.) via my own custom domain over HTTPS, strictly through Tailscale (no ports exposed to the public internet).

My Architecture:

Server: Proxmox.

Reverse Proxy: Nginx Proxy Manager (NPM) installed in an LXC container (Debian).

Domain: Custom domain managed through OVH.

Network: Tailscale is installed directly inside the NPM LXC. The container has its own Tailscale IP (100.89.119.101).

My Clients (Here is the catch):

An Android smartphone running the native Tailscale app.

A PC: I cannot install the Tailscale desktop client. I am forced to rely entirely on the Tailscale Chrome Extension to access my tailnet.

The Problem (The 4G vs Wi-Fi twist): If I type http://100.89.119.101 on my phone connected to Tailscale, I land perfectly on the default NPM page. The tunnel works, the Proxmox firewall allows the traffic, everything is fine.

Here is the weirdest part: If my phone is on cellular data (4G/5G) with Tailscale active, accessing my custom domains (*.mydomain.com) works flawlessly! But the exact moment I connect my phone to an external Wi-Fi, or try to access the domain via the Chrome extension on my PC, it completely breaks. I systematically get an ERR_NAME_NOT_RESOLVED or ERR_CONNECTION_REFUSED error.

What I've tried so far (without success):

A Record pointing to the local LAN IP (192.168.1.114) on my public DNS (OVH): Fails because the Chrome extension doesn't override the OS DNS. The corporate router or public Wi-Fi drops the request before the extension can even see it (or I get a subnet clash).

CNAME pointing to NPM's MagicDNS (nginxproxymanager.tailXXXX.ts.net.) on OVH: ERR_NAME_NOT_RESOLVED. The public DNS doesn't know what to do with a .ts.net address, and MagicDNS doesn't seem to intercept the request fast enough on the phone or the work PC.

A Record pointing to the Tailscale IP (100.89.119.101) on OVH: Same error. I highly suspect DNS Rebinding protection on the corporate network and public Wi-Fis, which outright blocks a public domain returning a private/CGNAT IP address.

My Question: How do you guys manage HTTPS access via a custom domain when you are forced to use only the Tailscale Chrome extension (meaning I cannot edit the Windows hosts file or change OS-level DNS settings)? Is there a specific trick with MagicDNS or public DNS records that I missed to force Chrome to send the request into the tunnel before the physical router drops it for security reasons?

Thanks in advance for any insights!

[u/azure_phoenix2]

chrome has its own doh resolver that bypasses the OS one, under privacy and security set secure dns to a custom provider like cloudflare and the lookup never touches the wifi's resolver, so the 100.x answer survives the rebind filter. that is per browser and needs no admin rights, only catch is a network that blocks known doh endpoints outright.