Short answer: self-host a DERP relay when a known network constraint justifies owning another public service. It is not automatically a speed, privacy, or security upgrade; it adds certificates, monitoring, patching, and a possible failure path.
When can it be justified?
A relay may be reasonable when direct paths consistently fail, a required location has restrictive egress, or an operator needs a controlled fallback. First establish that the problem is reachability rather than DNS, policy, endpoint state, or an unrelated network fault.
What does ownership add?
You own the host, public exposure, certificate lifecycle, updates, logs, availability, and recovery procedure. Keep the relay separate from sensitive control planes where practical, limit administration to private access, and monitor both relay health and client behavior.
Compare the relay trade-off with the broader Tailscale peer-relay security model and Tailscale server notes.