diff --git a/net/dns/config.go b/net/dns/config.go
index aff502331..48abebe0a 100644
--- a/net/dns/config.go
+++ b/net/dns/config.go
@@ -6,6 +6,7 @@
 
 import (
 	"sort"
+	"strings"
 
 	"inet.af/netaddr"
 )
@@ -91,14 +92,14 @@ func (c Config) matchDomains() []string {
 		if seen[suffix] {
 			continue
 		}
-		ret = append(ret, suffix)
+		ret = append(ret, strings.TrimSuffix(suffix, "."))
 		seen[suffix] = true
 	}
 	for suffix := range c.Routes {
 		if seen[suffix] {
 			continue
 		}
-		ret = append(ret, suffix)
+		ret = append(ret, strings.TrimSuffix(suffix, "."))
 		seen[suffix] = true
 	}
 	sort.Strings(ret)
diff --git a/net/dns/manager.go b/net/dns/manager.go
index cf0b0412b..04589bd67 100644
--- a/net/dns/manager.go
+++ b/net/dns/manager.go
@@ -154,7 +154,7 @@ func (m *Manager) compileConfig(cfg Config) (resolver.Config, OSConfig, error) {
 		LocalDomains: addFQDNDots(cfg.AuthoritativeSuffixes),
 	}
 	for suffix, resolvers := range cfg.Routes {
-		rcfg.Routes[suffix+"."] = resolvers
+		rcfg.Routes[suffix] = resolvers
 	}
 	ocfg = OSConfig{
 		Nameservers:   []netaddr.IP{tsaddr.TailscaleServiceIP()},