diff --git a/net/dns/direct.go b/net/dns/direct.go
index 5742d2d21..d74e2bc89 100644
--- a/net/dns/direct.go
+++ b/net/dns/direct.go
@@ -50,6 +50,10 @@ func readResolv(r io.Reader) (config OSConfig, err error) {
 	scanner := bufio.NewScanner(r)
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
+		i := strings.IndexByte(line, '#')
+		if i >= 0 {
+			line = line[:i]
+		}
 
 		if strings.HasPrefix(line, "nameserver") {
 			nameserver := strings.TrimPrefix(line, "nameserver")
diff --git a/net/dns/direct_test.go b/net/dns/direct_test.go
index 07147b669..6cd8ff8c5 100644
--- a/net/dns/direct_test.go
+++ b/net/dns/direct_test.go
@@ -14,6 +14,7 @@
 	"syscall"
 	"testing"
 
+	qt "github.com/frankban/quicktest"
 	"inet.af/netaddr"
 	"tailscale.com/util/dnsname"
 )
@@ -138,3 +139,46 @@ func TestDirectBrokenRemove(t *testing.T) {
 	}
 	testDirect(t, brokenRemoveFS{directFS{prefix: tmp}})
 }
+
+func TestReadResolve(t *testing.T) {
+	c := qt.New(t)
+	tests := []struct {
+		in      string
+		want    OSConfig
+		wantErr bool
+	}{
+		{in: `nameserver 192.168.0.100`,
+			want: OSConfig{
+				Nameservers: []netaddr.IP{
+					netaddr.MustParseIP("192.168.0.100"),
+				},
+			},
+		},
+		{in: `nameserver 192.168.0.100 # comment`,
+			want: OSConfig{
+				Nameservers: []netaddr.IP{
+					netaddr.MustParseIP("192.168.0.100"),
+				},
+			},
+		},
+		{in: `nameserver 192.168.0.100#`,
+			want: OSConfig{
+				Nameservers: []netaddr.IP{
+					netaddr.MustParseIP("192.168.0.100"),
+				},
+			},
+		},
+		{in: `nameserver #192.168.0.100`, wantErr: true},
+		{in: `# nameserver 192.168.0.100`, want: OSConfig{}},
+	}
+
+	for _, test := range tests {
+		cfg, err := readResolv(strings.NewReader(test.in))
+		if test.wantErr {
+			c.Assert(err, qt.IsNotNil)
+		} else {
+			c.Assert(err, qt.IsNil)
+		}
+		c.Assert(cfg, qt.DeepEquals, test.want)
+	}
+}