How-to: when Tailscale takes over your DNS

--accept-dns defaults to true, so joining a tailnet quietly replaces the resolver you configured. How to tell, what each fix costs, and why no test reports a problem.

TL;DR

Tailscale's --accept-dns defaults to true. Joining a tailnet hands DNS on that device to the tailnet configuration.
Your configured encrypted resolver is not removed or disabled - it is simply never asked. Nothing errors, nothing is logged.
The only notice is a comment in /etc/resolv.conf saying the file is generated and must not be edited.
Three checks: the resolv.conf header, tailscale dns status (which prints the revert command itself), and tailscale dns query, whose Forwarding to resolver line is the direct answer.
Three fixes, not equivalent: --accept-dns=false (loses MagicDNS names), setting your own resolver as the tailnet nameserver (keeps both - usually the right one), or Split DNS.
A leak test will call the result fine, because it answers a different question.

Full write-up: Accept DNS Configuration: Why Tailscale Replaced Your Resolver.