Creators of Tailscale think differently: https://tailscale.com/blog/sisyphean-dns-client-linux

Having tried similar things myself, I concur. One way to add a bit of sanity is to mandate running dnsmasq which has reasonable control interfaces, but it's overkill.