You can do this two ways: either create records on your public DNS host pointing to private IP addresses or using Split DNS and pointing your domain search to your own private DNS service using the Admin Console: https://tailscale.com/kb/1054/dns/

I do the latter as I want a consistent interface when I'm on and off tailscale. My self hosted services are all accessible via service.mydomain.com and my DNS server resolves them to IP addresses on my LAN. Setting up a tailscale subnet router allows my DNS service able to be accessed by all devices.

Do you have magicdns enabled or disabled for this?

Sure, this works fine. As far as DNS is concerned, Tailscale IP addresses are the same as any others.

The way I do this is that I registered a domain, say, example.com. Then I set up public DNS records as follows:

Then for services I run, I set up records like so:

(I could use A/AAAA records there, but I'm not worried about a little extra overhead.)

One advantage of this setup is that I can provision SSL certs (via Caddy, etc.) for intranet sites using DNS challenges.

Finally (and not required), I have my local DNS at home set up (via dnsmasq on my router) so that hostname.example.com resolves to a LAN IP rather than a Tailscale IP. That way, I can access local services from other LAN devices even if they don't have the Tailscale client installed.

Do you have magicdns enabled or disabled for this?