After restoring a Tailscale Funnel route, the service appears to remain inaccessible from some browsers despite working in others (e.g. works in Brave but not Firefox). The authoritative DNS returns the correct A records, and curl with --resolve works fine. Root cause: Firefox maintains its own DNS cache separate from the OS, and often uses DNS-over-HTTPS (DoH) via Cloudflare (1.1.1.1) by default. While the Funnel was down, the NXDOMAIN response was cached by multiple resolvers independently — the OS resolver, Google DNS (8.8.8.8), Cloudflare (1.1.1.1), and Firefox's internal cache. Even after the OS resolver clears, Firefox's DoH resolver and internal cache may still serve the stale NXDOMAIN.
Firefox caches DNS independently from the OS resolver. Navigate to about:networking#dns in Firefox and click 'Clear DNS Cache'. The underlying issue is negative DNS caching (NXDOMAIN TTL) across multiple layers: authoritative TTL was 300s but each resolver (OS, browser, DoH upstream) caches independently and may take different amounts of time to flush. When diagnosing 'works in one browser but not another', always suspect per-browser DNS caching, especially Firefox's built-in DoH.