Provider-neutral self-test pilot
Tailscale is the case on this list where an unchanged result is the right result. Its documentation describes an overlay network that routes traffic between devices running Tailscale and leaves your public internet traffic alone unless you deliberately select an exit node. Every device has to opt in to using one, and exit nodes need approval on the network first. So a reading that shows your ordinary address usually means Tailscale is behaving exactly as documented.
Live test
Unless you have selected an exit node, Tailscale leaves your public traffic alone, so this page reporting your usual address is the documented behaviour and not a leak.
Current-session checks
Read the signals before and after enabling Tailscale, and note whether an exit node is selected. Without one, the two readings should look the same.
Before you read the result
The points below come from Tailscale's own documentation on exit nodes and on how names are resolved inside a tailnet.
Tailscale describes itself as an overlay network that only routes traffic between devices running Tailscale, leaving public internet traffic untouched unless an exit node is configured. If you never selected one, this page will report the address your connection always had, and that is the product working rather than failing.
The documentation states that every device must explicitly opt in to using an exit node, and that a node has to be approved before it can act as one. Two separate decisions therefore stand between installing Tailscale and seeing a different address here, which is more than most people expect.
MagicDNS resolves machine names within your own network to fully qualified names built from the machine name and your network's own DNS name, and Tailscale documents that the nameservers you configure receive the queries MagicDNS does not handle. Those are two different populations of query. Only the second reaches the public internet, and only the second is what a DNS check on this page can observe, so a reading here says nothing at all about how your own machines find each other.
It is worth stating plainly because it is unusual: on Tailscale without an exit node, a check that shows your own address, your own resolver and your own country has not found a leak. It has confirmed the scope of the product, which is connectivity between your devices.
Once a device routes through an exit node, public traffic follows that path and the address here should become the exit node's. That is the point to rerun these checks, because it is the only configuration in which the page is measuring what most readers came to measure.
Between the readings
Unless you have selected an exit node, Tailscale leaves your public address alone, so most readings here will show your own network by design. A recording is still the way to watch what changes when a connection drops.
Safe Copy exports use safe summary categories and remove raw IP, exact city, full user-agent, raw fingerprint data, raw resolver IPs and WebRTC candidates. It is not a certificate, provider audit, or proof of anonymity.
FAQ
Tailscale documents itself as an overlay network that routes traffic between your own devices and leaves public internet traffic untouched unless an exit node is selected. Without one, nothing about your public address should move.
The documentation describes exit nodes as requiring approval on the network, and every device as having to opt in explicitly. Both steps have to be done before public traffic follows that path.
MagicDNS resolves machine names inside your own network. Queries it does not handle go to the nameservers you configured, and those are the only ones a public check on this page could observe.
Not on Tailscale without an exit node. It is the documented scope of the product. The reading only becomes evidence of a problem once an exit node is selected and the address still does not move.
Not directly. It can show you the address a website sees, which will match the exit node once one is in use. The client is the authority on which configuration is live.
They are outside this reading entirely. A page in one browser describes that browser, and says nothing about how another machine on the same network is routing its traffic.