From GPT (I pasted results of some terminal commands to it): Current state
Your /etc/hosts is default (my note, i dont think this is true?) ...
So right now nothing is short-circuiting login.tailscale.com → your system resolver must ask your full DNS chain every time. That’s exactly why ping flips between “works” and “can’t resolve” — you’re at the mercy of how the multiple resolvers in scutil handle the fallback.