diff --git a/hscontrol/types/config.go b/hscontrol/types/config.go
index 7661f372..7bae745e 100644
--- a/hscontrol/types/config.go
+++ b/hscontrol/types/config.go
@@ -779,6 +779,7 @@ func dnsToTailcfgDNS(dns DNSConfig) *tailcfg.DNSConfig {
 	cfg.Routes = routes
 	if dns.BaseDomain != "" {
 		cfg.Domains = []string{dns.BaseDomain}
+		cfg.CertDomains = cfg.Domains
 	}
 	cfg.Domains = append(cfg.Domains, dns.SearchDomains...)