diff --git a/protocol/tailscale/dns_transport.go b/protocol/tailscale/dns_transport.go
index 97b920b92..08876ea9d 100644
--- a/protocol/tailscale/dns_transport.go
+++ b/protocol/tailscale/dns_transport.go
@@ -267,7 +267,7 @@ func (t *DNSTransport) PreferredDomain(domain string) bool {
 		return true
 	}
 	for suffix := range routes {
-		if strings.HasSuffix(domain, suffix) {
+		if mDNS.IsSubDomain(suffix, domain) {
 			return true
 		}
 	}
@@ -377,7 +377,7 @@ func (t *DNSTransport) exchangeOnce(ctx context.Context, message *mDNS.Msg, allo
 		}
 	}
 	for domainSuffix, transports := range routes {
-		if strings.HasSuffix(question.Name, domainSuffix) {
+		if mDNS.IsSubDomain(domainSuffix, question.Name) {
 			if len(transports) == 0 {
 				callback(&mDNS.Msg{
 					MsgHdr: mDNS.MsgHdr{
diff --git a/service/resolved/transport.go b/service/resolved/transport.go
index afe4be516..c918870a1 100644
--- a/service/resolved/transport.go
+++ b/service/resolved/transport.go
@@ -6,7 +6,6 @@ import (
 	"context"
 	"net/netip"
 	"os"
-	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -202,7 +201,7 @@ func (t *Transport) PreferredDomain(domain string) bool {
 			if linkDomain.Domain == "." {
 				continue
 			}
-			if strings.HasSuffix(domain, linkDomain.Domain) {
+			if mDNS.IsSubDomain(linkDomain.Domain, domain) {
 				return true
 			}
 		}
@@ -234,7 +233,7 @@ func (t *Transport) ExchangeAsync(ctx context.Context, message *mDNS.Msg, callba
 			if domain.Domain == "." && domain.RoutingOnly && !t.acceptDefaultResolvers {
 				continue
 			}
-			if strings.HasSuffix(question.Name, domain.Domain) {
+			if mDNS.IsSubDomain(domain.Domain, question.Name) {
 				selectedLink = link
 			}
 		}