Cannot resolve `~.` domain

From https://github.com/tailscale/tailscale/issues/9243

--------

I have found what may be a similar problem that I discovered while testing a captive portal on Ubuntu without a VPN.

Setup:

Router R with IP 192.168.20.1
Router R is also a DNS Resolver.
Router R is DHCP server for the /24 and hands out 192.168.20.1 as DNS.
Host X with stock Ubuntu 22.04.1 with single interface ens3, connected to Internet via R

1. Install & configure tailscale on X
2. tailscale up on X.
3. Note now that via resolvectl ens3 no longer resolves DNS Domain "~." but tailscale0 does.
4. Turn on captive portal on R
5. Boom, no more DNS resolution on X (can't reach 100.100.100.100) - can't reach captive portal on R.
6. Fix by adding \~. to ens3 (resolvectl doman ens3 "\~.")
7. Now can get to captive portal.

_Originally posted by @scottmsilver in https://github.com/tailscale/tailscale/issues/9243#issuecomment-1710202458_