Tailscale has a NextDNS integration, so I use that to point my made-up internal domain to the Tailscale ip of my NAS. Works well with subdomains. When I’m on my local network (and not connected to Tailscale), my pihole directs the same url to the local ip.

To clarify, when you’re external or on the tailnet, you want the Tailscale ip. On the local network, you want the local ip.

Have you ever used Little Snitch? It’s another great MacOS app that has an outbound firewall. It’s been updated to include a DNS ad-blocker too.

I’ve been very happy with it for many years, but I’m always open to trying out alternatives. Thanks for sharing!