Windows Engineer

Tailscale expands from VPN into full connectivity platform. Application Infrastructure August 31, 2026 Highlights. * Tailscale is expanding beyond its original VPN product with new services introduced at its Tailscale Up conference. * The new offerings include DNS Filtering by Control D, Tailscale PAM, Aperture, Aperture Plus, Tailcat, and developer APIs and SDKs. * Tailscale said its identity-based access model now supports services for DNS control, privileged access, AI agents, and software development. Tailscale, which began in 2019 as a VPN provider based on open-source WireGuard technology, is moving beyond its original VPN pitch with a series of new products. The company raised $160 million last year to expand its WireGuard-based VPN platform and used its Tailscale Up conference last week to introduce new services built on identity-based access. Tailscale ties access to a device or user identity rather than to an IP address and applies policy based on that identity to determine what can be reached. The company said that model now underpins a broader set of tools, including DNS Filtering by Control D, Tailscale PAM, Aperture, Aperture Plus, Tailcat, and developer APIs and SDKs. DNS Filtering by Control D is sold and managed through existing Tailscale policy to block malicious and unapproved destinations. Tailscale PAM, now in beta, adds credential injection and just-in-time access for sensitive infrastructure. The company said it acquired Border0 in March 2026, and that Tailscale PAM lets teams grant one-click access to servers, databases, Kubernetes clusters, and web applications without handing out standing passwords or API keys. Aperture is Tailscale's AI gateway and reached general availability at the event. It gives AI agents an identity on a tailnet and routes their model calls and tool use through Tailscale's private network rather than the open internet. Aperture Plus extends the same access model into a browser, works without installing Tailscale as a system-level VPN, and isolates each session. Tailscale also introduced SDKs for Rust, Python, C, C++ and Elixir, along with a Tailnet Creation API and declarative tailnet sharing. company spotlight SoftIron. SoftIron makes the products that underpin the next evolution of IT infrastructure. Its blueprint is radical. Taking full control over design and manufacture of platforms optimised to transform IT infrastructure, its highly integrated products reduce space and energy footprints while delivering extraordinary performance. Challenging traditional IT manufacturing & organisational strategy, IT Infrastructure has developed a model that enables IT Infrastructure to create a more resilient and connected business for the customers IT Infrastructure serve. A commitment to openness, transparency, and simplicity helps address emerging multi-faceted threats while eliminating the vendor "lock-in" so common elsewhere.

Control D is now available through Tailscale. Buy Control D directly through Tailscale and filter every device on your tailnet, with different policies by user, group, or tag. Control D can now be purchased directly through Tailscale. Point your tailnet at Control D and every device on it is filtered, with different policies for users, groups, and tags. Teams have been running Control D natively on their tailnets for some years now. While Tailscale connects your devices into a private network and controls what they can reach inside it, Control D handles the other half, providing controls and filters for access to the public internet. Running both meant managing two separate vendors and invoices. Today ControlD Inc is proud to make it official and partner with Tailscale. You can now buy Control D directly through them, and run it across every device on your tailnet from a single vendor. How the partnership works. In Control D, a Profile is the set of rules you want enforced, and an Endpoint is a resolver that enforces one. Every Endpoint has a Resolver ID. Add Control D as a nameserver in the Tailscale admin console, paste the resolver ID in, switch on Override DNS servers, and every device on your tailnet resolves through it, with nothing to install and no network changes. Its docs cover the details. What's new is the commercial side. Tailscale's team handles your day-to-day support, and ours behind them on anything deeper. Policy management stays where it is, in your Control D Dashboard and API. What Control D adds to your tailnet. Threats stopped at the resolver. Control D checks every query against curated threat feeds, then against the domains and IPs those campaigns are built on, so infrastructure caught once stays caught when it resurfaces under a new name. Unknown domains are scored by machine learning and blocked if they look high risk. Control D has consistently ranked first in independent malware filter tests, most recently with a 99.98% block rate. Beyond malware and phishing, 20+ native content categories and over 1,000 services and apps can each be allowed, blocked, or redirected individually for granular policy control. Policies that follow your tailnet. Different parts of your tailnet can enforce different rules. In your tailnet policy file, nodeAttrs maps users, groups, or tags to a Control D Endpoint, so filtering inherits the structure you already built for network access. Tag a machine and its policy follows, without enrolling each device in Control D separately. Where a device inherits more than one tag, priority values decide which one wins. This shares only device hostnames with Control D, and you control how much query data is kept. More than one tailnet. Plenty of teams run several, whether that is production and staging, one per subsidiary, one per department/team, or one per client if you are an MSP. Organizations and Sub-Organizations give each its own policy scope, Shared Profiles push a common baseline across all of them, and delegated administration lets whoever runs one manage it without touching the others. Getting started. Already using Tailscale? Talk to the Tailscale sales team about adding Control D to your plan.