[angott]

Tailscale runs its own local DNS resolver on your computer at 100.100.100.100, if you have enabled that in settings. Your DNS queries don't go to any Tailscale servers. By default, the client simply forwards all queries to the system DNS resolver, providing some added conveniences like automatic DNS over HTTPS upgrade when available. Also, you don't really have to use Tailscale for DNS if you're comfortable reaching your devices using their 100.x.y.z IP address. See https://tailscale.com/kb/1081/magicdns for more details.

And yes, Tailscale keeps a connection open to its servers to allow other devices to reach you when you're behind a firewall and direct connections can't be established.