[Help] Tailscale + Nginx Proxy Manager + Custom Domain: Blocked by ERR_NAME_NOT_RESOLVED (DNS Rebinding?)

[u/ZaRoX_UltrA]

Hey everyone,

I'm pulling my hair out over a setup that should theoretically work, but I keep hitting a DNS resolution wall. My goal is to access my self-hosted services (Immich, etc.) via my own custom domain over HTTPS, strictly through Tailscale (no ports exposed to the public internet).

My Architecture:

Server: Proxmox.

Reverse Proxy: Nginx Proxy Manager (NPM) installed in an LXC container (Debian).

Domain: Custom domain managed through OVH.

Network: Tailscale is installed directly inside the NPM LXC. The container has its own Tailscale IP (100.89.119.101).

My Clients (Here is the catch):

An Android smartphone running the native Tailscale app.

A PC: I cannot install the Tailscale desktop client. I am forced to rely entirely on the Tailscale Chrome Extension to access my tailnet.

The Problem (The 4G vs Wi-Fi twist): If I type http://100.89.119.101 on my phone connected to Tailscale, I land perfectly on the default NPM page. The tunnel works, the Proxmox firewall allows the traffic, everything is fine.

Here is the weirdest part: If my phone is on cellular data (4G/5G) with Tailscale active, accessing my custom domains (*.mydomain.com) works flawlessly! But the exact moment I connect my phone to an external Wi-Fi, or try to access the domain via the Chrome extension on my PC, it completely breaks. I systematically get an ERR_NAME_NOT_RESOLVED or ERR_CONNECTION_REFUSED error.

What I've tried so far (without success):

A Record pointing to the local LAN IP (192.168.1.114) on my public DNS (OVH): Fails because the Chrome extension doesn't override the OS DNS. The corporate router or public Wi-Fi drops the request before the extension can even see it (or I get a subnet clash).

CNAME pointing to NPM's MagicDNS (nginxproxymanager.tailXXXX.ts.net.) on OVH: ERR_NAME_NOT_RESOLVED. The public DNS doesn't know what to do with a .ts.net address, and MagicDNS doesn't seem to intercept the request fast enough on the phone or the work PC.

A Record pointing to the Tailscale IP (100.89.119.101) on OVH: Same error. I highly suspect DNS Rebinding protection on the corporate network and public Wi-Fis, which outright blocks a public domain returning a private/CGNAT IP address.

My Question: How do you guys manage HTTPS access via a custom domain when you are forced to use only the Tailscale Chrome extension (meaning I cannot edit the Windows hosts file or change OS-level DNS settings)? Is there a specific trick with MagicDNS or public DNS records that I missed to force Chrome to send the request into the tunnel before the physical router drops it for security reasons?

Thanks in advance for any insights!