Run a DNS server, either shared one(s) inside the tunnel or locally on each host. In case of the latter you don't even need systemd-resolved anymore. Unless yo

Run a DNS server, either shared one(s) inside the tunnel or locally on each host. In case of the latter you don't even need systemd-resolved anymore. Unless you have reasons to prefer BIND, I'd recommend dnsmasq (most popular lightweight) or coredns (intuitive straightforward conf, also lightweight). You can set them as authoritative for your own domain and forward the rest to whatever you use for DNS otherwise.