Using a split DNS configuration for important services such that the DNS server only listens over a secure tunnel like Tailscale is one of the most user-friendly approaches to prevent DNS spoofing. Options like [DNSSEC](https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en) are viable, but require very skilled and patient operators. Overall, DNS spoofing is such a low-level attack that it's very difficult to fully prevent without a lot of effort.
Another strategy to prevent DNS spoofing attacks is to use [DNS over HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS) wherever possible. DNS over HTTPS uses a secure connection to perform DNS queries. When you set up a DNS server for your tailnet with Tailscale, Tailscale will automatically upgrade your client's DNS requests to use DNS over HTTPS without any extra work required on your part.