diff --git a/cmd/tailscaled/tailscaled.go b/cmd/tailscaled/tailscaled.go
index 86669d383..c5b3980df 100644
--- a/cmd/tailscaled/tailscaled.go
+++ b/cmd/tailscaled/tailscaled.go
@@ -338,7 +338,7 @@ func tryEngine(logf logger.Logf, linkMon *monitor.Mon, name string) (e wgengine.
 	}
 	useNetstack = name == "userspace-networking"
 	if !useNetstack {
-		dev, err := tstun.New(logf, name)
+		dev, devName, err := tstun.New(logf, name)
 		if err != nil {
 			tstun.Diagnose(logf, name)
 			return nil, false, err
@@ -350,13 +350,7 @@ func tryEngine(logf logger.Logf, linkMon *monitor.Mon, name string) (e wgengine.
 			return nil, false, err
 		}
 		conf.Router = r
-		tunname, err := dev.Name()
-		if err != nil {
-			r.Close()
-			dev.Close()
-			return nil, false, err
-		}
-		conf.DNS = dns.NewOSConfigurator(logf, tunname)
+		conf.DNS = dns.NewOSConfigurator(logf, devName)
 	}
 	e, err = wgengine.NewUserspaceEngine(logf, conf)
 	if err != nil {
diff --git a/cmd/tailscaled/tailscaled_windows.go b/cmd/tailscaled/tailscaled_windows.go
index b57190b7e..6a4c94149 100644
--- a/cmd/tailscaled/tailscaled_windows.go
+++ b/cmd/tailscaled/tailscaled_windows.go
@@ -30,6 +30,7 @@ import (
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 	"tailscale.com/ipn/ipnserver"
 	"tailscale.com/logpolicy"
+	"tailscale.com/net/dns"
 	"tailscale.com/net/tstun"
 	"tailscale.com/tempfork/wireguard-windows/firewall"
 	"tailscale.com/types/logger"
@@ -161,7 +162,7 @@ func startIPNServer(ctx context.Context, logid string) error {
 	var err error
 
 	getEngine := func() (wgengine.Engine, error) {
-		dev, err := tstun.New(logf, "Tailscale")
+		dev, devName, err := tstun.New(logf, "Tailscale")
 		if err != nil {
 			return nil, err
 		}
@@ -173,6 +174,7 @@ func startIPNServer(ctx context.Context, logid string) error {
 		eng, err := wgengine.NewUserspaceEngine(logf, wgengine.Config{
 			Tun:        dev,
 			Router:     r,
+			DNS:        dns.NewOSConfigurator(logf, devName),
 			ListenPort: 41641,
 		})
 		if err != nil {
diff --git a/net/tstun/tun.go b/net/tstun/tun.go
index d480d3244..4e0187ed4 100644
--- a/net/tstun/tun.go
+++ b/net/tstun/tun.go
@@ -28,16 +28,23 @@ import (
 // discovery.
 const minimalMTU = 1280
 
-// New returns a tun.Device for the requested device name.
-func New(logf logger.Logf, tunName string) (tun.Device, error) {
+// New returns a tun.Device for the requested device name, along with
+// the OS-dependent name that was allocated to the device.
+func New(logf logger.Logf, tunName string) (tun.Device, string, error) {
 	dev, err := tun.CreateTUN(tunName, minimalMTU)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 	if err := waitInterfaceUp(dev, 90*time.Second, logf); err != nil {
-		return nil, err
+		dev.Close()
+		return nil, "", err
 	}
-	return dev, nil
+	name, err := interfaceName(dev)
+	if err != nil {
+		dev.Close()
+		return nil, "", err
+	}
+	return dev, name, nil
 }
 
 // Diagnose tries to explain a tuntap device creation failure.
diff --git a/net/tstun/tun_notwindows.go b/net/tstun/tun_notwindows.go
new file mode 100644
index 000000000..078bccd47
--- /dev/null
+++ b/net/tstun/tun_notwindows.go
@@ -0,0 +1,13 @@
+// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !windows
+
+package tstun
+
+import "github.com/tailscale/wireguard-go/tun"
+
+func interfaceName(dev tun.Device) (string, error) {
+	return dev.Name()
+}
diff --git a/net/tstun/tun_windows.go b/net/tstun/tun_windows.go
index dc5fc2d79..786c09408 100644
--- a/net/tstun/tun_windows.go
+++ b/net/tstun/tun_windows.go
@@ -8,6 +8,7 @@ import (
 	"github.com/tailscale/wireguard-go/tun"
 	"github.com/tailscale/wireguard-go/tun/wintun"
 	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 )
 
 func init() {
@@ -22,3 +23,11 @@ func init() {
 	}
 	tun.WintunStaticRequestedGUID = &guid
 }
+
+func interfaceName(dev tun.Device) (string, error) {
+	guid, err := winipcfg.LUID(dev.(*tun.NativeTun).LUID()).GUID()
+	if err != nil {
+		return "", err
+	}
+	return guid.String(), nil
+}