[Feature] Restricted nameservers without search domains

[casdr]

Use case

I use the restricted_nameservers option for my own implementation of App Connectors (the DNS server adds routes to the subnet router) so I can route services like 1Password over the tailnet. The issue with the current implementation is that 1password.com will also be added as a search domain, which I don't want.

Description

It would be nice if it was possible to add a restricted nameserver without the domain being added as a searchdomain.

Contribution

• I can write the design doc for this feature
• I can contribute this feature

How can it be implemented?

I've been digging in the Tailscale client sourcecode, and I think this can be implemented by adding the domain to DNSConfig.MatchDomains instead of DNSConfig.SearchDomains, but I'm not really sure about this.