Resilient Home DNS

Design principle: DNS should keep working when one local service disappears, but the fallback should not become a public resolver.

The pattern

Clients receive a local AdGuard resolver and a small Raspberry Pi DNS bridge. The Pi prefers the local resolver and can fall back across Tailscale to an off-site AdGuard instance.

Why it works

Normal queries stay local and fast.
A local container outage does not immediately remove DNS.
The VPS resolver is reachable over a private Tailscale path rather than exposed to the internet.
Internal split-DNS names remain local.