When MagicDNS works via dig but not via apps on macOS, list /etc/resolver/ and look for files left by other VPN or mesh tools (EasyTier, etc.). Move the offending search-domain file out (sudo mv /etc/resolver/[name] /etc/resolver-disabled/), then sudo dscacheutil -flushcache and sudo killall -HUP mDNSResponder. Verify with dscacheutil -q host -a name [short-name]. Durable fix: disable the third party's short-name or search-domain integration so it stops recreating the file, and use fully qualified names for its domains instead.

Context: GitHub issue tailscale/tailscale#20890 (closed, 5 comments): MagicDNS short names stopped resolving on macOS while dig at 100.100.100.100 worked fine and scutil --dns showed the Tailscale resolver correctly. The reporter first suspected DHCP-advertised encrypted DNS (DNR/DDR), but the actual trigger was a stale third-party search-domain file: EasyTier had dropped /etc/resolver/search.easytier containing a search directive pointing at its own DNS server, and the file survived after EasyTier was stopped, so short-name lookups fell into a dead resolver.