Forward Deployed Engineer

Control D is now available through Tailscale. Buy Control D directly through Tailscale and filter every device on your tailnet, with different policies by user, group, or tag. Control D can now be purchased directly through Tailscale. Point your tailnet at Control D and every device on it is filtered, with different policies for users, groups, and tags. Teams have been running Control D natively on their tailnets for some years now. While Tailscale connects your devices into a private network and controls what they can reach inside it, Control D handles the other half, providing controls and filters for access to the public internet. Running both meant managing two separate vendors and invoices. Today ControlD Inc is proud to make it official and partner with Tailscale. You can now buy Control D directly through them, and run it across every device on your tailnet from a single vendor. How the partnership works. In Control D, a Profile is the set of rules you want enforced, and an Endpoint is a resolver that enforces one. Every Endpoint has a Resolver ID. Add Control D as a nameserver in the Tailscale admin console, paste the resolver ID in, switch on Override DNS servers, and every device on your tailnet resolves through it, with nothing to install and no network changes. Its docs cover the details. What's new is the commercial side. Tailscale's team handles your day-to-day support, and ours behind them on anything deeper. Policy management stays where it is, in your Control D Dashboard and API. What Control D adds to your tailnet. Threats stopped at the resolver. Control D checks every query against curated threat feeds, then against the domains and IPs those campaigns are built on, so infrastructure caught once stays caught when it resurfaces under a new name. Unknown domains are scored by machine learning and blocked if they look high risk. Control D has consistently ranked first in independent malware filter tests, most recently with a 99.98% block rate. Beyond malware and phishing, 20+ native content categories and over 1,000 services and apps can each be allowed, blocked, or redirected individually for granular policy control. Policies that follow your tailnet. Different parts of your tailnet can enforce different rules. In your tailnet policy file, nodeAttrs maps users, groups, or tags to a Control D Endpoint, so filtering inherits the structure you already built for network access. Tag a machine and its policy follows, without enrolling each device in Control D separately. Where a device inherits more than one tag, priority values decide which one wins. This shares only device hostnames with Control D, and you control how much query data is kept. More than one tailnet. Plenty of teams run several, whether that is production and staging, one per subsidiary, one per department/team, or one per client if you are an MSP. Organizations and Sub-Organizations give each its own policy scope, Shared Profiles push a common baseline across all of them, and delegated administration lets whoever runs one manage it without touching the others. Getting started. Already using Tailscale? Talk to the Tailscale sales team about adding Control D to your plan.

Tailscale Open sources Tailcat, WireGuard netcat alternative. 1h ago Open Source Tl;dr. Tailscale releases Tailcat, a userspace tool combining WireGuard encryption and NAT traversal without requiring Tailscale's control plane, enabling encrypted peer-to-peer connections via simple token exchange. Key points. * Tailcat reuses Tailscale's magicsock (NAT traversal), userspace WireGuard, and gVisor netstack without requiring control plane or root access * Connection tokens encode server's WireGuard key and DERP relay info; clients bootstrap through DERP, upgrade to direct P2P UDP when possible

Tailscale launches DNS filtering add-on with Control D. Thu, 27th Aug 2026 (Today) Tailscale has launched a DNS filtering add-on for business customers in partnership with Control D. The product is called DNS Filtering by Control D. The add-on lets organisations block malicious, phishing and unwanted domains across users and devices, while applying different filtering profiles through Tailscale policy. Customers can buy the service through Tailscale instead of managing a separate purchasing process. The launch expands the companies' existing relationship and targets a growing security concern for distributed workforces. DNS filtering works when a device requests the address of an internet destination, giving administrators a way to block access before a connection is established. The issue has grown more important as staff connect from home networks, public networks and mobile devices rather than only through office infrastructure. The companies also pointed to automated workloads and AI agents as another area where organisations want tighter control over which outside destinations systems can reach. The Anti-Phishing Working Group recorded more than 970,000 phishing attacks in the first quarter of 2026, up 14% from the previous quarter, according to figures cited by the companies. They also pointed to recent attacks in which compromised home and small-office routers were used to hijack DNS requests. How It Works Organisations can create filtering policies in Control D and assign them through Tailscale policy based on user groups, tags and device attributes. A company could apply one rule set to employees, another to contractors and another to tagged machines running automated tasks. The filtering follows devices connected through Tailscale rather than relying on traffic passing through a central office network. DNS queries are sent directly from the device to Control D using DNS-over-HTTPS, an encrypted method for handling requests. Customers continue to manage blocklists, category filters, exceptions and DNS activity through the Control D dashboard. Organisations that already buy Control D separately can continue using the existing integration. Tailscale placed particular emphasis on DNS controls for AI systems that can browse the web, call application programming interfaces or download software without direct human action. In that setting, administrators may want to limit external destinations for the same reasons they do for employees. "AI agents are just another thing on the network, except they can make a lot of decisions very quickly," said Avery Pennarun, Co-founder and CEO, Tailscale. "If they can browse the web, call APIs, or download software, you need clear limits on where they can go. Tailscale provides the identity and policy context, and Control D can stop connections to known malicious or unapproved domains before they start. That gives organizations a practical guardrail for both people and agents without inspecting the contents of encrypted traffic." Control D said the combined approach brings identity and network policy together in one framework for customers already using Tailscale to manage access. "Tailscale already knows who a user or agent is, what device they're using, and what policy applies to them. Control D is really good at deciding which destinations should and shouldn't be reachable. Putting those together means customers don't have to maintain two separate policy worlds. The same identity that decides what you can connect to can also help decide where you're allowed to connect," said Catt Garrod, COO, Control D. Market Position Tailscale said it is used by more than 30,000 businesses globally, including large technology groups and media companies. Founded in 2019, the company focuses on private network access and identity-based controls built around WireGuard. Control D was spun out of Windscribe in 2021 and is based in Toronto. It sells DNS filtering and security tools to businesses, schools and managed service providers, and said its platform applies policies across major operating systems. The new add-on is available to existing Tailscale business customers through their account teams. Organisations new to Tailscale can register interest to be contacted.