diff --git a/ipn/ipnlocal/dnsconfig_test.go b/ipn/ipnlocal/dnsconfig_test.go
index a27d1824b..c2f26b016 100644
--- a/ipn/ipnlocal/dnsconfig_test.go
+++ b/ipn/ipnlocal/dnsconfig_test.go
@@ -51,7 +51,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			nm:    &netmap.NetworkMap{},
 			prefs: &ipn.Prefs{},
 			want: &dns.Config{
-				Routes: map[dnsname.FQDN][]dnstype.Resolver{},
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{},
 				Hosts:  map[dnsname.FQDN][]netaddr.IP{},
 			},
 		},
@@ -77,7 +77,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			},
 			prefs: &ipn.Prefs{},
 			want: &dns.Config{
-				Routes: map[dnsname.FQDN][]dnstype.Resolver{},
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{},
 				Hosts: map[dnsname.FQDN][]netaddr.IP{
 					"b.net.":       ips("100.102.0.1", "100.102.0.2"),
 					"myname.net.":  ips("100.101.101.101"),
@@ -112,7 +112,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			prefs: &ipn.Prefs{},
 			want: &dns.Config{
 				OnlyIPv6: true,
-				Routes:   map[dnsname.FQDN][]dnstype.Resolver{},
+				Routes:   map[dnsname.FQDN][]*dnstype.Resolver{},
 				Hosts: map[dnsname.FQDN][]netaddr.IP{
 					"b.net.":       ips("fe75::2"),
 					"myname.net.":  ips("fe75::1"),
@@ -136,7 +136,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			},
 			prefs: &ipn.Prefs{},
 			want: &dns.Config{
-				Routes: map[dnsname.FQDN][]dnstype.Resolver{},
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{},
 				Hosts: map[dnsname.FQDN][]netaddr.IP{
 					"myname.net.": ips("100.101.101.101"),
 					"foo.com.":    ips("1.2.3.4"),
@@ -158,7 +158,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			},
 			want: &dns.Config{
 				Hosts: map[dnsname.FQDN][]netaddr.IP{},
-				Routes: map[dnsname.FQDN][]dnstype.Resolver{
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{
 					"0.e.1.a.c.5.1.1.a.7.d.f.ip6.arpa.": nil,
 					"100.100.in-addr.arpa.":             nil,
 					"101.100.in-addr.arpa.":             nil,
@@ -242,13 +242,13 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			os:   "android",
 			nm: &netmap.NetworkMap{
 				DNS: tailcfg.DNSConfig{
-					Resolvers: []dnstype.Resolver{
+					Resolvers: []*dnstype.Resolver{
 						{Addr: "8.8.8.8"},
 					},
-					FallbackResolvers: []dnstype.Resolver{
+					FallbackResolvers: []*dnstype.Resolver{
 						{Addr: "8.8.4.4"},
 					},
-					Routes: map[string][]dnstype.Resolver{
+					Routes: map[string][]*dnstype.Resolver{
 						"foo.com.": {{Addr: "1.2.3.4"}},
 					},
 				},
@@ -258,10 +258,10 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			},
 			want: &dns.Config{
 				Hosts: map[dnsname.FQDN][]netaddr.IP{},
-				DefaultResolvers: []dnstype.Resolver{
+				DefaultResolvers: []*dnstype.Resolver{
 					{Addr: "8.8.8.8"},
 				},
-				Routes: map[dnsname.FQDN][]dnstype.Resolver{
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{
 					"foo.com.": {{Addr: "1.2.3.4"}},
 				},
 			},
@@ -270,7 +270,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			name: "exit_nodes_need_fallbacks",
 			nm: &netmap.NetworkMap{
 				DNS: tailcfg.DNSConfig{
-					FallbackResolvers: []dnstype.Resolver{
+					FallbackResolvers: []*dnstype.Resolver{
 						{Addr: "8.8.4.4"},
 					},
 				},
@@ -281,8 +281,8 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			},
 			want: &dns.Config{
 				Hosts:  map[dnsname.FQDN][]netaddr.IP{},
-				Routes: map[dnsname.FQDN][]dnstype.Resolver{},
-				DefaultResolvers: []dnstype.Resolver{
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{},
+				DefaultResolvers: []*dnstype.Resolver{
 					{Addr: "8.8.4.4"},
 				},
 			},
@@ -291,7 +291,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			name: "not_exit_node_NOT_need_fallbacks",
 			nm: &netmap.NetworkMap{
 				DNS: tailcfg.DNSConfig{
-					FallbackResolvers: []dnstype.Resolver{
+					FallbackResolvers: []*dnstype.Resolver{
 						{Addr: "8.8.4.4"},
 					},
 				},
@@ -301,7 +301,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			},
 			want: &dns.Config{
 				Hosts:  map[dnsname.FQDN][]netaddr.IP{},
-				Routes: map[dnsname.FQDN][]dnstype.Resolver{},
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{},
 			},
 		},
 	}
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 2d2d0f90d..147d20e0c 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -2112,7 +2112,7 @@ func (b *LocalBackend) authReconfig() {
 // a runtime.GOOS.
 func dnsConfigForNetmap(nm *netmap.NetworkMap, prefs *ipn.Prefs, logf logger.Logf, versionOS string) *dns.Config {
 	dcfg := &dns.Config{
-		Routes: map[dnsname.FQDN][]dnstype.Resolver{},
+		Routes: map[dnsname.FQDN][]*dnstype.Resolver{},
 		Hosts:  map[dnsname.FQDN][]netaddr.IP{},
 	}
 
@@ -2199,8 +2199,9 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, prefs *ipn.Prefs, logf logger.Log
 		}
 	}
 
-	addDefault := func(resolvers []dnstype.Resolver) {
+	addDefault := func(resolvers []*dnstype.Resolver) {
 		for _, r := range resolvers {
+			r := r
 			dcfg.DefaultResolvers = append(dcfg.DefaultResolvers, r)
 		}
 	}
@@ -2208,7 +2209,7 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, prefs *ipn.Prefs, logf logger.Log
 	// If we're using an exit node and that exit node is new enough (1.19.x+)
 	// to run a DoH DNS proxy, then send all our DNS traffic through it.
 	if dohURL, ok := exitNodeCanProxyDNS(nm, prefs.ExitNodeID); ok {
-		addDefault([]dnstype.Resolver{{Addr: dohURL}})
+		addDefault([]*dnstype.Resolver{{Addr: dohURL}})
 		return dcfg
 	}
 
@@ -2227,7 +2228,7 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, prefs *ipn.Prefs, logf logger.Log
 		//
 		// While we're already populating it, might as well size the
 		// slice appropriately.
-		dcfg.Routes[fqdn] = make([]dnstype.Resolver, 0, len(resolvers))
+		dcfg.Routes[fqdn] = make([]*dnstype.Resolver, 0, len(resolvers))
 
 		for _, r := range resolvers {
 			dcfg.Routes[fqdn] = append(dcfg.Routes[fqdn], r)
diff --git a/net/dns/config.go b/net/dns/config.go
index 883f4dd30..d3046a82c 100644
--- a/net/dns/config.go
+++ b/net/dns/config.go
@@ -22,14 +22,14 @@ type Config struct {
 	// which aren't covered by more specific per-domain routes below.
 	// If empty, the OS's default resolvers (the ones that predate
 	// Tailscale altering the configuration) are used.
-	DefaultResolvers []dnstype.Resolver
+	DefaultResolvers []*dnstype.Resolver
 	// Routes maps a DNS suffix to the resolvers that should be used
 	// for queries that fall within that suffix.
 	// If a query doesn't match any entry in Routes, the
 	// DefaultResolvers are used.
 	// A Routes entry with no resolvers means the route should be
 	// authoritatively answered using the contents of Hosts.
-	Routes map[dnsname.FQDN][]dnstype.Resolver
+	Routes map[dnsname.FQDN][]*dnstype.Resolver
 	// SearchDomains are DNS suffixes to try when expanding
 	// single-label queries.
 	SearchDomains []dnsname.FQDN
@@ -98,9 +98,9 @@ func (c Config) hasDefaultResolvers() bool {
 // singleResolverSet returns the resolvers used by c.Routes if all
 // routes use the same resolvers, or nil if multiple sets of resolvers
 // are specified.
-func (c Config) singleResolverSet() []dnstype.Resolver {
+func (c Config) singleResolverSet() []*dnstype.Resolver {
 	var (
-		prev            []dnstype.Resolver
+		prev            []*dnstype.Resolver
 		prevInitialized bool
 	)
 	for _, resolvers := range c.Routes {
@@ -128,7 +128,7 @@ func (c Config) matchDomains() []dnsname.FQDN {
 	return ret
 }
 
-func sameResolverNames(a, b []dnstype.Resolver) bool {
+func sameResolverNames(a, b []*dnstype.Resolver) bool {
 	if len(a) != len(b) {
 		return false
 	}
diff --git a/net/dns/manager.go b/net/dns/manager.go
index 9b0fef4a1..59bcdcf17 100644
--- a/net/dns/manager.go
+++ b/net/dns/manager.go
@@ -144,7 +144,7 @@ func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig
 	// authoritative suffixes, even if we don't propagate MagicDNS to
 	// the OS.
 	rcfg.Hosts = cfg.Hosts
-	routes := map[dnsname.FQDN][]dnstype.Resolver{} // assigned conditionally to rcfg.Routes below.
+	routes := map[dnsname.FQDN][]*dnstype.Resolver{} // assigned conditionally to rcfg.Routes below.
 	for suffix, resolvers := range cfg.Routes {
 		if len(resolvers) == 0 {
 			rcfg.LocalDomains = append(rcfg.LocalDomains, suffix)
@@ -225,9 +225,9 @@ func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig
 			health.SetDNSOSHealth(err)
 			return resolver.Config{}, OSConfig{}, err
 		}
-		var defaultRoutes []dnstype.Resolver
+		var defaultRoutes []*dnstype.Resolver
 		for _, ip := range bcfg.Nameservers {
-			defaultRoutes = append(defaultRoutes, dnstype.Resolver{Addr: ip.String()})
+			defaultRoutes = append(defaultRoutes, &dnstype.Resolver{Addr: ip.String()})
 		}
 		rcfg.Routes["."] = defaultRoutes
 		ocfg.SearchDomains = append(ocfg.SearchDomains, bcfg.SearchDomains...)
@@ -239,7 +239,7 @@ func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig
 // toIPsOnly returns only the IP portion of dnstype.Resolver.
 // Only safe to use if the resolvers slice has been cleared of
 // DoH or custom-port entries with something like hasDefaultIPResolversOnly.
-func toIPsOnly(resolvers []dnstype.Resolver) (ret []netaddr.IP) {
+func toIPsOnly(resolvers []*dnstype.Resolver) (ret []netaddr.IP) {
 	for _, r := range resolvers {
 		if ipp, ok := r.IPPort(); ok && ipp.Port() == 53 {
 			ret = append(ret, ipp.IP())
diff --git a/net/dns/manager_test.go b/net/dns/manager_test.go
index ef47571ea..68e68a7db 100644
--- a/net/dns/manager_test.go
+++ b/net/dns/manager_test.go
@@ -437,9 +437,9 @@ func mustIPPs(strs ...string) (ret []netaddr.IPPort) {
 	return ret
 }
 
-func mustRes(strs ...string) (ret []dnstype.Resolver) {
+func mustRes(strs ...string) (ret []*dnstype.Resolver) {
 	for _, s := range strs {
-		ret = append(ret, dnstype.Resolver{Addr: s})
+		ret = append(ret, &dnstype.Resolver{Addr: s})
 	}
 	return ret
 }
@@ -495,9 +495,9 @@ func hostsR(strs ...string) (ret map[dnsname.FQDN][]dnstype.Resolver) {
 	return ret
 }
 
-func upstreams(strs ...string) (ret map[dnsname.FQDN][]dnstype.Resolver) {
+func upstreams(strs ...string) (ret map[dnsname.FQDN][]*dnstype.Resolver) {
 	var key dnsname.FQDN
-	ret = map[dnsname.FQDN][]dnstype.Resolver{}
+	ret = map[dnsname.FQDN][]*dnstype.Resolver{}
 	for _, s := range strs {
 		if s == "" {
 			if key == "" {
@@ -508,14 +508,14 @@ func upstreams(strs ...string) (ret map[dnsname.FQDN][]dnstype.Resolver) {
 			if key == "" {
 				panic("IPPort provided before suffix")
 			}
-			ret[key] = append(ret[key], dnstype.Resolver{Addr: ipp.String()})
+			ret[key] = append(ret[key], &dnstype.Resolver{Addr: ipp.String()})
 		} else if _, err := netaddr.ParseIP(s); err == nil {
 			if key == "" {
 				panic("IPPort provided before suffix")
 			}
-			ret[key] = append(ret[key], dnstype.Resolver{Addr: s})
+			ret[key] = append(ret[key], &dnstype.Resolver{Addr: s})
 		} else if strings.HasPrefix(s, "http") {
-			ret[key] = append(ret[key], dnstype.Resolver{Addr: s})
+			ret[key] = append(ret[key], &dnstype.Resolver{Addr: s})
 		} else {
 			fqdn, err := dnsname.ToFQDN(s)
 			if err != nil {
diff --git a/net/dns/resolver/forwarder.go b/net/dns/resolver/forwarder.go
index f00a887d2..613e9f912 100644
--- a/net/dns/resolver/forwarder.go
+++ b/net/dns/resolver/forwarder.go
@@ -170,7 +170,7 @@ type route struct {
 // long to wait before querying it.
 type resolverAndDelay struct {
 	// name is the upstream resolver.
-	name dnstype.Resolver
+	name *dnstype.Resolver
 
 	// startDelay is an amount to delay this resolver at
 	// start. It's used when, say, there are four Google or
@@ -246,7 +246,7 @@ func (f *forwarder) Close() error {
 // resolversWithDelays maps from a set of DNS server names to a slice of a type
 // that included a startDelay, upgrading any well-known DoH (DNS-over-HTTP)
 // servers in the process, insert a DoH lookup first before UDP fallbacks.
-func resolversWithDelays(resolvers []dnstype.Resolver) []resolverAndDelay {
+func resolversWithDelays(resolvers []*dnstype.Resolver) []resolverAndDelay {
 	rr := make([]resolverAndDelay, 0, len(resolvers)+2)
 
 	// Add the known DoH ones first, starting immediately.
@@ -261,7 +261,7 @@ func resolversWithDelays(resolvers []dnstype.Resolver) []resolverAndDelay {
 			continue
 		}
 		didDoH[dohBase] = true
-		rr = append(rr, resolverAndDelay{name: dnstype.Resolver{Addr: dohBase}})
+		rr = append(rr, resolverAndDelay{name: &dnstype.Resolver{Addr: dohBase}})
 	}
 
 	type hostAndFam struct {
@@ -300,7 +300,7 @@ type hostAndFam struct {
 // Resolver.SetConfig on reconfig.
 //
 // The memory referenced by routesBySuffix should not be modified.
-func (f *forwarder) setRoutes(routesBySuffix map[dnsname.FQDN][]dnstype.Resolver) {
+func (f *forwarder) setRoutes(routesBySuffix map[dnsname.FQDN][]*dnstype.Resolver) {
 	routes := make([]route, 0, len(routesBySuffix))
 	for suffix, rs := range routesBySuffix {
 		routes = append(routes, route{
diff --git a/net/dns/resolver/forwarder_test.go b/net/dns/resolver/forwarder_test.go
index 02d3afb5b..4c8deca74 100644
--- a/net/dns/resolver/forwarder_test.go
+++ b/net/dns/resolver/forwarder_test.go
@@ -23,9 +23,9 @@ func (rr resolverAndDelay) String() string {
 
 func TestResolversWithDelays(t *testing.T) {
 	// query
-	q := func(ss ...string) (ipps []dnstype.Resolver) {
+	q := func(ss ...string) (ipps []*dnstype.Resolver) {
 		for _, host := range ss {
-			ipps = append(ipps, dnstype.Resolver{Addr: host})
+			ipps = append(ipps, &dnstype.Resolver{Addr: host})
 		}
 		return
 	}
@@ -42,7 +42,7 @@ func TestResolversWithDelays(t *testing.T) {
 				}
 			}
 			rr = append(rr, resolverAndDelay{
-				name:       dnstype.Resolver{Addr: s},
+				name:       &dnstype.Resolver{Addr: s},
 				startDelay: d,
 			})
 		}
@@ -51,7 +51,7 @@ func TestResolversWithDelays(t *testing.T) {
 
 	tests := []struct {
 		name string
-		in   []dnstype.Resolver
+		in   []*dnstype.Resolver
 		want []resolverAndDelay
 	}{
 		{
diff --git a/net/dns/resolver/tsdns.go b/net/dns/resolver/tsdns.go
index dbb665bc3..27aa87e04 100644
--- a/net/dns/resolver/tsdns.go
+++ b/net/dns/resolver/tsdns.go
@@ -66,7 +66,7 @@ type Config struct {
 	// queries within that suffix.
 	// Queries only match the most specific suffix.
 	// To register a "default route", add an entry for ".".
-	Routes map[dnsname.FQDN][]dnstype.Resolver
+	Routes map[dnsname.FQDN][]*dnstype.Resolver
 	// LocalHosts is a map of FQDNs to corresponding IPs.
 	Hosts map[dnsname.FQDN][]netaddr.IP
 	// LocalDomains is a list of DNS name suffixes that should not be
@@ -115,7 +115,7 @@ func WriteIPPorts(w *bufio.Writer, vv []netaddr.IPPort) {
 }
 
 // WriteDNSResolver writes r to w.
-func WriteDNSResolver(w *bufio.Writer, r dnstype.Resolver) {
+func WriteDNSResolver(w *bufio.Writer, r *dnstype.Resolver) {
 	io.WriteString(w, r.Addr)
 	if len(r.BootstrapResolution) > 0 {
 		w.WriteByte('(')
@@ -129,7 +129,7 @@ func WriteDNSResolver(w *bufio.Writer, r dnstype.Resolver) {
 }
 
 // WriteDNSResolvers writes resolvers to w.
-func WriteDNSResolvers(w *bufio.Writer, resolvers []dnstype.Resolver) {
+func WriteDNSResolvers(w *bufio.Writer, resolvers []*dnstype.Resolver) {
 	w.WriteByte('[')
 	for i, r := range resolvers {
 		if i > 0 {
@@ -142,7 +142,7 @@ func WriteDNSResolvers(w *bufio.Writer, resolvers []dnstype.Resolver) {
 
 // WriteRoutes writes routes to w, omitting *.arpa routes and instead
 // summarizing how many of them there were.
-func WriteRoutes(w *bufio.Writer, routes map[dnsname.FQDN][]dnstype.Resolver) {
+func WriteRoutes(w *bufio.Writer, routes map[dnsname.FQDN][]*dnstype.Resolver) {
 	var kk []dnsname.FQDN
 	arpa := 0
 	for k := range routes {
@@ -347,7 +347,7 @@ func (r *Resolver) HandleExitNodeDNSQuery(ctx context.Context, q []byte, from ne
 			// will use its default ones from our DNS config.
 		} else {
 			resolvers = []resolverAndDelay{{
-				name: dnstype.Resolver{Addr: net.JoinHostPort(nameserver.String(), "53")},
+				name: &dnstype.Resolver{Addr: net.JoinHostPort(nameserver.String(), "53")},
 			}}
 		}
 
diff --git a/net/dns/resolver/tsdns_test.go b/net/dns/resolver/tsdns_test.go
index f46e8d693..fd43078eb 100644
--- a/net/dns/resolver/tsdns_test.go
+++ b/net/dns/resolver/tsdns_test.go
@@ -480,10 +480,10 @@ func TestDelegate(t *testing.T) {
 	defer r.Close()
 
 	cfg := dnsCfg
-	cfg.Routes = map[dnsname.FQDN][]dnstype.Resolver{
+	cfg.Routes = map[dnsname.FQDN][]*dnstype.Resolver{
 		".": {
-			dnstype.Resolver{Addr: v4server.PacketConn.LocalAddr().String()},
-			dnstype.Resolver{Addr: v6server.PacketConn.LocalAddr().String()},
+			&dnstype.Resolver{Addr: v4server.PacketConn.LocalAddr().String()},
+			&dnstype.Resolver{Addr: v6server.PacketConn.LocalAddr().String()},
 		},
 	}
 	r.SetConfig(cfg)
@@ -655,7 +655,7 @@ func TestDelegateSplitRoute(t *testing.T) {
 	defer r.Close()
 
 	cfg := dnsCfg
-	cfg.Routes = map[dnsname.FQDN][]dnstype.Resolver{
+	cfg.Routes = map[dnsname.FQDN][]*dnstype.Resolver{
 		".":      {{Addr: server1.PacketConn.LocalAddr().String()}},
 		"other.": {{Addr: server2.PacketConn.LocalAddr().String()}},
 	}
@@ -947,7 +947,7 @@ func BenchmarkFull(b *testing.B) {
 	defer r.Close()
 
 	cfg := dnsCfg
-	cfg.Routes = map[dnsname.FQDN][]dnstype.Resolver{
+	cfg.Routes = map[dnsname.FQDN][]*dnstype.Resolver{
 		".": {{Addr: server.PacketConn.LocalAddr().String()}},
 	}
 
diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index c71b8bb5c..c4ee1bcc8 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -1003,7 +1003,7 @@ type FilterRule struct {
 // DNSConfig is the DNS configuration.
 type DNSConfig struct {
 	// Resolvers are the DNS resolvers to use, in order of preference.
-	Resolvers []dnstype.Resolver `json:",omitempty"`
+	Resolvers []*dnstype.Resolver `json:",omitempty"`
 
 	// Routes maps DNS name suffixes to a set of DNS resolvers to
 	// use. It is used to implement "split DNS" and other advanced DNS
@@ -1015,13 +1015,13 @@ type DNSConfig struct {
 	// If the value is an empty slice, that means the suffix should still
 	// be handled by Tailscale's built-in resolver (100.100.100.100), such
 	// as for the purpose of handling ExtraRecords.
-	Routes map[string][]dnstype.Resolver `json:",omitempty"`
+	Routes map[string][]*dnstype.Resolver `json:",omitempty"`
 
 	// FallbackResolvers is like Resolvers, but is only used if a
 	// split DNS configuration is requested in a configuration that
 	// doesn't work yet without explicit default resolvers.
 	// https://github.com/tailscale/tailscale/issues/1743
-	FallbackResolvers []dnstype.Resolver `json:",omitempty"`
+	FallbackResolvers []*dnstype.Resolver `json:",omitempty"`
 	// Domains are the search domains to use.
 	// Search domains must be FQDNs, but *without* the trailing dot.
 	Domains []string `json:",omitempty"`
diff --git a/tailcfg/tailcfg_clone.go b/tailcfg/tailcfg_clone.go
index 1f56698d9..047705bfe 100644
--- a/tailcfg/tailcfg_clone.go
+++ b/tailcfg/tailcfg_clone.go
@@ -193,19 +193,19 @@ func (src *DNSConfig) Clone() *DNSConfig {
 	}
 	dst := new(DNSConfig)
 	*dst = *src
-	dst.Resolvers = make([]dnstype.Resolver, len(src.Resolvers))
+	dst.Resolvers = make([]*dnstype.Resolver, len(src.Resolvers))
 	for i := range dst.Resolvers {
-		dst.Resolvers[i] = *src.Resolvers[i].Clone()
+		dst.Resolvers[i] = src.Resolvers[i].Clone()
 	}
 	if dst.Routes != nil {
-		dst.Routes = map[string][]dnstype.Resolver{}
+		dst.Routes = map[string][]*dnstype.Resolver{}
 		for k := range src.Routes {
-			dst.Routes[k] = append([]dnstype.Resolver{}, src.Routes[k]...)
+			dst.Routes[k] = append([]*dnstype.Resolver{}, src.Routes[k]...)
 		}
 	}
-	dst.FallbackResolvers = make([]dnstype.Resolver, len(src.FallbackResolvers))
+	dst.FallbackResolvers = make([]*dnstype.Resolver, len(src.FallbackResolvers))
 	for i := range dst.FallbackResolvers {
-		dst.FallbackResolvers[i] = *src.FallbackResolvers[i].Clone()
+		dst.FallbackResolvers[i] = src.FallbackResolvers[i].Clone()
 	}
 	dst.Domains = append(src.Domains[:0:0], src.Domains...)
 	dst.Nameservers = append(src.Nameservers[:0:0], src.Nameservers...)
@@ -217,9 +217,9 @@ func (src *DNSConfig) Clone() *DNSConfig {
 
 // A compilation failure here means this code must be regenerated, with the command at the top of this file.
 var _DNSConfigCloneNeedsRegeneration = DNSConfig(struct {
-	Resolvers           []dnstype.Resolver
-	Routes              map[string][]dnstype.Resolver
-	FallbackResolvers   []dnstype.Resolver
+	Resolvers           []*dnstype.Resolver
+	Routes              map[string][]*dnstype.Resolver
+	FallbackResolvers   []*dnstype.Resolver
 	Domains             []string
 	Proxied             bool
 	Nameservers         []netaddr.IP
diff --git a/tstest/integration/vms/harness_test.go b/tstest/integration/vms/harness_test.go
index 386015d6e..ea4623c9c 100644
--- a/tstest/integration/vms/harness_test.go
+++ b/tstest/integration/vms/harness_test.go
@@ -64,7 +64,7 @@ func newHarness(t *testing.T) *Harness {
 			// TODO: this is wrong.
 			// It is also only one of many configurations.
 			// Figure out how to scale it up.
-			Resolvers:    []dnstype.Resolver{{Addr: "100.100.100.100"}, {Addr: "8.8.8.8"}},
+			Resolvers:    []*dnstype.Resolver{{Addr: "100.100.100.100"}, {Addr: "8.8.8.8"}},
 			Domains:      []string{"record"},
 			Proxied:      true,
 			ExtraRecords: []tailcfg.DNSRecord{{Name: "extratest.record", Type: "A", Value: "1.2.3.4"}},
diff --git a/util/deephash/deephash_test.go b/util/deephash/deephash_test.go
index ddbe3e94e..bccebba62 100644
--- a/util/deephash/deephash_test.go
+++ b/util/deephash/deephash_test.go
@@ -192,7 +192,7 @@ func getVal() []any {
 				},
 			},
 			DNSConfig: &tailcfg.DNSConfig{
-				Resolvers: []dnstype.Resolver{
+				Resolvers: []*dnstype.Resolver{
 					{Addr: "10.0.0.1"},
 				},
 			},
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index 036cc7da7..18866ab77 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -1586,7 +1586,7 @@ func ipInPrefixes(ip netaddr.IP, pp []netaddr.IPPrefix) bool {
 func dnsIPsOverTailscale(dnsCfg *dns.Config, routerCfg *router.Config) (ret []netaddr.IPPrefix) {
 	m := map[netaddr.IP]bool{}
 
-	add := func(resolvers []dnstype.Resolver) {
+	add := func(resolvers []*dnstype.Resolver) {
 		for _, r := range resolvers {
 			ip, err := netaddr.ParseIP(r.Addr)
 			if err != nil {