I found that the cname record seemed to be the problem. Here someone had the same issue. After changing now to a wildcard A record pointing to the tailscale ip, it all magically works. Thanks for all the answers!