Tailscale launches DNS filtering add-on with Control D

Tailscale has launched a DNS filtering add-on for business customers in partnership with Control D. The product is called DNS Filtering by Control D.

The add-on lets organisations block malicious, phishing and unwanted domains across users and devices, while applying different filtering profiles through Tailscale policy. Customers can buy the service through Tailscale instead of managing a separate purchasing process.

The launch expands the companies' existing relationship and targets a growing security concern for distributed workforces. DNS filtering works when a device requests the address of an internet destination, giving administrators a way to block access before a connection is established.

The issue has grown more important as staff connect from home networks, public networks and mobile devices rather than only through office infrastructure. The companies also pointed to automated workloads and AI agents as another area where organisations want tighter control over which outside destinations systems can reach.

The Anti-Phishing Working Group recorded more than 970,000 phishing attacks in the first quarter of 2026, up 14% from the previous quarter, according to figures cited by the companies. They also pointed to recent attacks in which compromised home and small-office routers were used to hijack DNS requests.

How It Works

Organisations can create filtering policies in Control D and assign them through Tailscale policy based on user groups, tags and device attributes. A company could apply one rule set to employees, another to contractors and another to tagged machines running automated tasks.

The filtering follows devices connected through Tailscale rather than relying on traffic passing through a central office network. DNS queries are sent directly from the device to Control D using DNS-over-HTTPS, an encrypted method for handling requests.

Customers continue to manage blocklists, category filters, exceptions and DNS activity through the Control D dashboard. Organisations that already buy Control D separately can continue using the existing integration.

AI Focus

Tailscale placed particular emphasis on DNS controls for AI systems that can browse the web, call application programming interfaces or download software without direct human action. In that setting, administrators may want to limit external destinations for the same reasons they do for employees.

"AI agents are just another thing on the network, except they can make a lot of decisions very quickly," said Avery Pennarun, Co-founder and CEO, Tailscale. "If they can browse the web, call APIs, or download software, you need clear limits on where they can go. Tailscale provides the identity and policy context, and Control D can stop connections to known malicious or unapproved domains before they start. That gives organizations a practical guardrail for both people and agents without inspecting the contents of encrypted traffic."

Control D said the combined approach brings identity and network policy together in one framework for customers already using Tailscale to manage access.

"Tailscale already knows who a user or agent is, what device they're using, and what policy applies to them. Control D is really good at deciding which destinations should and shouldn't be reachable. Putting those together means customers don't have to maintain two separate policy worlds. The same identity that decides what you can connect to can also help decide where you're allowed to connect," said Catt Garrod, COO, Control D.

Market Position

Tailscale said it is used by more than 30,000 businesses globally, including large technology groups and media companies. Founded in 2019, the company focuses on private network access and identity-based controls built around WireGuard.

Control D was spun out of Windscribe in 2021 and is based in Toronto. It sells DNS filtering and security tools to businesses, schools and managed service providers, and said its platform applies policies across major operating systems.

The new add-on is available to existing Tailscale business customers through their account teams. Organisations new to Tailscale can register interest to be contacted.