diff --git a/net/dns/config.go b/net/dns/config.go
index 718a409e31e81..527e74803110b 100644
--- a/net/dns/config.go
+++ b/net/dns/config.go
@@ -35,11 +35,3 @@ type Config struct {
 	// return NXDOMAIN.
 	AuthoritativeSuffixes []string
 }
-
-// OSConfig is an OS DNS configuration.
-type OSConfig struct {
-	// Nameservers are the IP addresses of the nameservers to use.
-	Nameservers []netaddr.IP
-	// Domains are the search domains to use.
-	Domains []string
-}
diff --git a/net/dns/direct.go b/net/dns/direct.go
index 058975bcd3558..7fdc633d7073b 100644
--- a/net/dns/direct.go
+++ b/net/dns/direct.go
@@ -159,8 +159,8 @@ func (m directManager) SetDNS(config OSConfig) error {
 	return nil
 }
 
-func (m directManager) RoutingMode() RoutingMode {
-	return RoutingModeNone
+func (m directManager) SupportsSplitDNS() bool {
+	return false
 }
 
 func (m directManager) Close() error {
diff --git a/net/dns/manager_windows.go b/net/dns/manager_windows.go
index c5fcd3716acd7..d14fa42efe155 100644
--- a/net/dns/manager_windows.go
+++ b/net/dns/manager_windows.go
@@ -113,8 +113,8 @@ func (m windowsManager) SetDNS(config OSConfig) error {
 	return nil
 }
 
-func (m windowsManager) RoutingMode() RoutingMode {
-	return RoutingModeNone
+func (m windowsManager) SupportsSplitDNS() bool {
+	return false
 }
 
 func (m windowsManager) Close() error {
diff --git a/net/dns/nm.go b/net/dns/nm.go
index 4e008a25a5ce9..243e9dfb478aa 100644
--- a/net/dns/nm.go
+++ b/net/dns/nm.go
@@ -200,7 +200,7 @@ func (m nmManager) SetDNS(config OSConfig) error {
 	return nil
 }
 
-func (m nmManager) RoutingMode() RoutingMode { return RoutingModeNone }
+func (m nmManager) SupportsSplitDNS() bool { return false }
 
 func (m nmManager) Close() error {
 	return m.SetDNS(OSConfig{})
diff --git a/net/dns/noop.go b/net/dns/noop.go
index 8a0fc213c2041..7391375ee6feb 100644
--- a/net/dns/noop.go
+++ b/net/dns/noop.go
@@ -6,9 +6,9 @@ package dns
 
 type noopManager struct{}
 
-func (m noopManager) SetDNS(OSConfig) error    { return nil }
-func (m noopManager) RoutingMode() RoutingMode { return RoutingModeNone }
-func (m noopManager) Close() error             { return nil }
+func (m noopManager) SetDNS(OSConfig) error  { return nil }
+func (m noopManager) SupportsSplitDNS() bool { return false }
+func (m noopManager) Close() error           { return nil }
 
 func NewNoopManager() noopManager {
 	return noopManager{}
diff --git a/net/dns/osconfig.go b/net/dns/osconfig.go
index 00eb8f44e5846..9299f78f28d22 100644
--- a/net/dns/osconfig.go
+++ b/net/dns/osconfig.go
@@ -4,22 +4,7 @@
 
 package dns
 
-// DNSRoutingMode describes the type of per-domain DNS routing that
-// the OS is capable of.
-type RoutingMode int
-
-const (
-	// RoutingModeNone means the OS only supports setting a single
-	// primary set of DNS resolvers.
-	RoutingModeNone RoutingMode = iota
-	// RoutingModeSingle means the OS supports a set of
-	// primary resolvers, as well as one set of additional per-suffix
-	// resolvers per network interface.
-	RoutingModeSingle
-	// RoutingModeMulti means the OS supports a set of primary
-	// resolvers, as well as an arbitrary overlay of DNS routes.
-	RoutingModeMulti
-)
+import "inet.af/netaddr"
 
 // An OSConfigurator applies DNS settings to the operating system.
 type OSConfigurator interface {
@@ -28,9 +13,25 @@ type OSConfigurator interface {
 	// configuration is removed.
 	// SetDNS must not be called after Close.
 	SetDNS(cfg OSConfig) error
-	// DNSRoutingMode reports the DNS routing capabilities of this OS
-	// configurator.
-	RoutingMode() RoutingMode
+	// SupportsSplitDNS reports whether the configurator is capable of
+	// installing a resolver only for specific DNS suffixes. If false,
+	// the configurator can only set a global resolver.
+	SupportsSplitDNS() bool
 	// Close removes Tailscale-related DNS configuration from the OS.
 	Close() error
 }
+
+// OSConfig is an OS DNS configuration.
+type OSConfig struct {
+	// Nameservers are the IP addresses of the nameservers to use.
+	Nameservers []netaddr.IP
+	// Domains are the search domains to use.
+	Domains []string
+	// Primary indicates whether to set Nameservers as the
+	// primary/"default" resolvers for the system.
+	// If false, Nameservers will be set as resolvers for Domains
+	// only.
+	// Primary=false is only allowed for OSConfigurators that report
+	// SupportsSplitDNS.
+	Primary bool
+}
diff --git a/net/dns/resolvconf.go b/net/dns/resolvconf.go
index 23de5b95d5110..7e0e608027543 100644
--- a/net/dns/resolvconf.go
+++ b/net/dns/resolvconf.go
@@ -138,8 +138,8 @@ func (m resolvconfManager) SetDNS(config OSConfig) error {
 	return nil
 }
 
-func (m resolvconfManager) RoutingMode() RoutingMode {
-	return RoutingModeNone
+func (m resolvconfManager) SupportsSplitDNS() bool {
+	return false
 }
 
 func (m resolvconfManager) Close() error {
diff --git a/net/dns/resolved.go b/net/dns/resolved.go
index ddae9b2e52548..fc3e2a61493fd 100644
--- a/net/dns/resolved.go
+++ b/net/dns/resolved.go
@@ -153,8 +153,8 @@ func (m resolvedManager) SetDNS(config OSConfig) error {
 	return nil
 }
 
-func (m resolvedManager) RoutingMode() RoutingMode {
-	return RoutingModeNone
+func (m resolvedManager) SupportsSplitDNS() bool {
+	return false
 }
 
 func (m resolvedManager) Close() error {
diff --git a/wgengine/router/callback.go b/wgengine/router/callback.go
index b36e399a372b7..b37d2700f3aa6 100644
--- a/wgengine/router/callback.go
+++ b/wgengine/router/callback.go
@@ -15,8 +15,8 @@ import (
 // Mainly used as a shim for OSes that want to set both network and
 // DNS configuration simultaneously (iOS, android).
 type CallbackRouter struct {
-	SetBoth func(rcfg *Config, dcfg *dns.OSConfig) error
-	DNSMode dns.RoutingMode
+	SetBoth  func(rcfg *Config, dcfg *dns.OSConfig) error
+	SplitDNS bool
 
 	mu   sync.Mutex    // protects all the following
 	rcfg *Config       // last applied router config
@@ -44,9 +44,9 @@ func (r *CallbackRouter) SetDNS(dcfg dns.OSConfig) error {
 	return r.SetBoth(r.rcfg, r.dcfg)
 }
 
-// RoutingMode implements dns.OSConfigurator.
-func (r *CallbackRouter) RoutingMode() dns.RoutingMode {
-	return r.DNSMode
+// SupportsSplitDNS implements dns.OSConfigurator.
+func (r *CallbackRouter) SupportsSplitDNS() bool {
+	return r.SplitDNS
 }
 
 func (r *CallbackRouter) Close() error {