Receipts
The sources ledger.
Every factual product claim on this site resolves to an entry here. The hierarchy: official documentation first, then the knowledge base, the changelog, the official blog, and the open source code itself. Third party writeups are leads for investigation, never citations. When official pages conflict, the narrowest current claim wins and the resolution is noted on this page.
| Source | Checked | Cited by |
|---|---|---|
| 4via6 subnet routers | 2026-08-10 | 07 Routing, drill: overlapping-subnet-routers |
| Access the Kubernetes control plane using an API server proxy | 2026-08-10 | 09 The platform matrix |
| ACL syntax reference | 2026-08-12 | 04 Identity and auth, 05 Policy: ACLs and grants, 07 Routing, drill: grants-migration-surprise, drill: acl-one-way-ping, drill: tag-ssh-lockout, recipe: pin-saas-egress-to-one-address, recipe: webhooks-without-a-tunnel-service, recipe: ssh-without-keys-with-receipts, recipe: vms-born-on-the-tailnet, lab: stand-up-a-relay-you-control |
| apitype package reference (WhoIsResponse) | 2026-08-11 | recipe: your-program-is-the-node |
| App connectors | 2026-08-11 | 07 Routing, recipe: pin-saas-egress-to-one-address, recipe: pin-saas-egress-to-one-address |
| Auth keys | 2026-08-11 | 02 The control plane, 04 Identity and auth, 09 The platform matrix, drill: key-expiry-outage, drill: ephemeral-node-vanished, drill: docker-node-multiplies, recipe: your-program-is-the-node, recipe: vms-born-on-the-tailnet |
| Autogroups | 2026-08-11 | 05 Policy: ACLs and grants, drill: tag-ssh-lockout, recipe: ssh-without-keys-with-receipts |
| Best practices for using app connectors | 2026-08-11 | recipe: pin-saas-egress-to-one-address |
| Can't connect to other tailnet devices | 2026-08-10 | drill: acl-one-way-ping, craft: repro-construction |
| Can't resolve domain names | 2026-08-10 | drill: magicdns-vpn-conflict |
| cmd/tailscale/cli directory listing | 2026-08-10 | lab: reading-go-for-investigation |
| Configuring Linux DNS | 2026-08-10 | 06 MagicDNS and split DNS |
| Connection types | 2026-08-12 | 03 NAT traversal, STUN, DERP, and Peer Relays, drill: exit-node-slow, drill: relay-stuck, drill: works-then-drops, craft: handoff-package, lab: where-does-your-traffic-actually-go, lab: both-sides-shouting-neither-hearing |
| Control and data planes | 2026-08-10 | 02 The control plane |
| Customize the Kubernetes operator and resources it manages | 2026-08-10 | 09 The platform matrix |
| Debug menu and options | 2026-08-10 | drill: macos-flap |
| Default DERP map | 2026-08-10 | drill: works-then-drops |
| DERP servers | 2026-08-10 | 03 NAT traversal, STUN, DERP, and Peer Relays, drill: exit-node-slow, drill: relay-stuck, drill: udp-blocked, drill: works-then-drops, lab: magicsock-guided-read, craft: handoff-package, lab: pcap-field-kit |
| DERP servers | 2026-08-12 | lab: where-does-your-traffic-actually-go, lab: both-sides-shouting-neither-hearing |
| Device approval | 2026-08-10 | 04 Identity and auth |
| Device posture | 2026-08-10 | 05 Policy: ACLs and grants |
| DNS in Tailscale (DNS settings) | 2026-08-10 | 06 MagicDNS and split DNS, 06 MagicDNS and split DNS, drill: magicdns-vpn-conflict, drill: split-dns-leak |
| Docker | 2026-08-10 | drill: docker-node-multiplies, craft: repro-construction |
| Docker configuration parameters | 2026-08-10 | 09 The platform matrix, drill: docker-node-multiplies, craft: repro-construction |
| Enabling HTTPS | 2026-08-11 | 08 Exposing services, recipe: webhooks-without-a-tunnel-service |
| Ephemeral nodes | 2026-08-10 | drill: ephemeral-node-vanished, drill: docker-node-multiplies, craft: repro-construction |
| Exit nodes | 2026-08-10 | 07 Routing, drill: exit-node-slow |
| Funnel and Serve use cases | 2026-08-11 | recipe: webhooks-without-a-tunnel-service |
| Generate a bug report | 2026-08-10 | craft: evidence-collection, craft: handoff-package |
| google/pprof tool documentation | 2026-08-10 | lab: pprof-field-kit |
| Grants | 2026-08-10 | 05 Policy: ACLs and grants, drill: grants-migration-surprise |
| Grants generally available as an easier option to ACL syntax | 2026-08-10 | 05 Policy: ACLs and grants |
| Grants: application capabilities (Tailscale docs) | 2026-08-11 | recipe: your-program-is-the-node |
| High availability | 2026-08-11 | 07 Routing, drill: overlapping-subnet-routers, recipe: pin-saas-egress-to-one-address |
| How NAT traversal works | 2026-08-12 | 03 NAT traversal, STUN, DERP, and Peer Relays, 12 The codebase, drill: relay-stuck, drill: works-then-drops, lab: magicsock-guided-read, lab: pcap-field-kit, craft: repro-construction, lab: stand-up-a-relay-you-control, lab: where-does-your-traffic-actually-go, lab: both-sides-shouting-neither-hearing |
| How Tailscale works | 2026-08-10 | 00 The shape of Tailscale, 02 The control plane, 05 Policy: ACLs and grants, 12 The codebase, lab: magicsock-guided-read |
| Identity providers | 2026-08-10 | 04 Identity and auth |
| Install Tailscale on iOS | 2026-08-10 | 09 The platform matrix |
| Install Tailscale on Linux | 2026-08-11 | 09 The platform matrix, recipe: vms-born-on-the-tailnet |
| Install Tailscale on Synology | 2026-08-10 | 09 The platform matrix |
| Install Tailscale on Windows | 2026-08-10 | 09 The platform matrix |
| Install the Tailscale Kubernetes Operator | 2026-08-10 | 09 The platform matrix |
| Introducing Tailscale Peer Relays (Tailscale blog, 2025-10-29) | 2026-08-10 | lab: magicsock-guided-read |
| IP addresses in the 100.x.y.z range | 2026-08-11 | 00 The shape of Tailscale, lab: pcap-field-kit, recipe: one-picker-for-the-whole-fleet |
| ipnlocal package source and doc comments (LocalBackend) | 2026-08-10 | lab: reading-go-for-investigation |
| ipnstate package reference (Status) | 2026-08-11 | recipe: your-program-is-the-node |
| Key expiry | 2026-08-10 | 00 The shape of Tailscale, 02 The control plane, 04 Identity and auth, 11 Troubleshooting and observability, drill: key-expiry-outage |
| Logging overview | 2026-08-10 | 11 Troubleshooting and observability, craft: evidence-collection |
| MagicDNS | 2026-08-11 | 00 The shape of Tailscale, 06 MagicDNS and split DNS, drill: magicdns-vpn-conflict, drill: split-dns-leak, recipe: one-picker-for-the-whole-fleet |
| Manage permissions using ACLs (tailnet policy file) | 2026-08-10 | 02 The control plane, 05 Policy: ACLs and grants, drill: acl-one-way-ping |
| net/http/pprof package documentation | 2026-08-10 | lab: pprof-field-kit |
| OAuth clients | 2026-08-10 | 04 Identity and auth |
| Open source at Tailscale | 2026-08-10 | 00 The shape of Tailscale, 02 The control plane, 12 The codebase, lab: reading-go-for-investigation |
| Package controlclient documentation | 2026-08-10 | 12 The codebase |
| Package derp documentation | 2026-08-10 | 12 The codebase |
| Package ipnlocal documentation | 2026-08-10 | 12 The codebase |
| Package magicsock documentation | 2026-08-10 | 12 The codebase |
| Package netcheck documentation | 2026-08-10 | 12 The codebase |
| Package tailcfg documentation | 2026-08-11 | 12 The codebase, recipe: your-program-is-the-node |
| Package tsnet documentation | 2026-08-11 | 12 The codebase, recipe: your-program-is-the-node |
| Peer relays | 2026-08-12 | 00 The shape of Tailscale, 02 The control plane, 03 NAT traversal, STUN, DERP, and Peer Relays, 11 Troubleshooting and observability, drill: exit-node-slow, drill: relay-stuck, lab: stand-up-a-relay-you-control, lab: both-sides-shouting-neither-hearing |
| Poor performance between tailnet devices | 2026-08-10 | craft: repro-construction |
| Protocol and Cryptography | 2026-08-10 | drill: works-then-drops, lab: pcap-field-kit |
| Quick guide to Tailscale on Docker | 2026-08-10 | 09 The platform matrix |
| Run Tailscale unattended on Windows | 2026-08-10 | 09 The platform matrix |
| runtime/pprof package documentation | 2026-08-10 | lab: pprof-field-kit |
| Secure your SaaS with Tailscale app connectors | 2026-08-11 | recipe: pin-saas-egress-to-one-address |
| Set up an app connector | 2026-08-11 | recipe: pin-saas-egress-to-one-address |
| Site-to-site networking | 2026-08-10 | 07 Routing |
| Subnet routers | 2026-08-10 | 07 Routing, drill: overlapping-subnet-routers, drill: route-not-approved |
| Tags | 2026-08-12 | 02 The control plane, 04 Identity and auth, 05 Policy: ACLs and grants, drill: key-expiry-outage, drill: tag-ssh-lockout, recipe: ssh-without-keys-with-receipts, recipe: vms-born-on-the-tailnet, lab: stand-up-a-relay-you-control |
| Tailnet name | 2026-08-10 | 06 MagicDNS and split DNS |
| Tailscale Acceptable Use Policy | 2026-08-11 | recipe: webhooks-without-a-tunnel-service |
| Tailscale changelog | 2026-08-11 | drill: exit-node-slow, drill: relay-stuck, craft: evidence-collection, recipe: webhooks-without-a-tunnel-service, recipe: ssh-without-keys-with-receipts |
| Tailscale CLI | 2026-08-12 | 03 NAT traversal, STUN, DERP, and Peer Relays, 06 MagicDNS and split DNS, 09 The platform matrix, 11 Troubleshooting and observability, drill: key-expiry-outage, drill: relay-stuck, drill: tag-ssh-lockout, drill: split-dns-leak, drill: udp-blocked, craft: live-incident-craft, craft: evidence-collection, craft: handoff-package, lab: pcap-field-kit, lab: pprof-field-kit, craft: repro-construction, recipe: one-picker-for-the-whole-fleet, recipe: pin-saas-egress-to-one-address, recipe: vms-born-on-the-tailnet, lab: stand-up-a-relay-you-control, lab: where-does-your-traffic-actually-go, lab: both-sides-shouting-neither-hearing |
| tailscale CLI debug command source (cmd/tailscale/cli/debug.go) | 2026-08-10 | lab: pprof-field-kit |
| Tailscale client metrics | 2026-08-10 | 11 Troubleshooting and observability, drill: route-not-approved, craft: evidence-collection, lab: pprof-field-kit |
| Tailscale Funnel | 2026-08-11 | 08 Exposing services, recipe: your-program-is-the-node, recipe: webhooks-without-a-tunnel-service, recipe: webhooks-without-a-tunnel-service |
| tailscale funnel command reference | 2026-08-11 | 08 Exposing services, recipe: webhooks-without-a-tunnel-service |
| Tailscale Funnel: Securely Expose Local Services to the Internet | 2026-08-11 | recipe: webhooks-without-a-tunnel-service |
| Tailscale Geneve header implementation (net/packet/geneve.go) | 2026-08-10 | lab: pcap-field-kit |
| Tailscale GitHub Action | 2026-08-10 | drill: ephemeral-node-vanished |
| Tailscale LocalAPI Go client source (client/local/local.go) | 2026-08-10 | lab: pprof-field-kit |
| Tailscale netfilter modes | 2026-08-10 | 07 Routing |
| Tailscale Peer Relays: Use your own devices as high-throughput relays | 2026-08-10 | 03 NAT traversal, STUN, DERP, and Peer Relays |
| Tailscale ping message types | 2026-08-10 | drill: acl-one-way-ping |
| Tailscale pricing and plans | 2026-08-11 | recipe: webhooks-without-a-tunnel-service, recipe: ssh-without-keys-with-receipts |
| Tailscale Serve | 2026-08-10 | 08 Exposing services |
| tailscale serve command reference | 2026-08-11 | 08 Exposing services, recipe: webhooks-without-a-tunnel-service |
| Tailscale Services | 2026-08-10 | 08 Exposing services, drill: grants-migration-surprise |
| Tailscale Services GA announcement | 2026-08-10 | 08 Exposing services |
| Tailscale SSH | 2026-08-11 | 05 Policy: ACLs and grants, drill: tag-ssh-lockout, recipe: one-picker-for-the-whole-fleet, recipe: ssh-without-keys-with-receipts, recipe: ssh-without-keys-with-receipts |
| Tailscale SSH session recording | 2026-08-11 | recipe: ssh-without-keys-with-receipts |
| tailscale status output source (cmd/tailscale/cli/status.go) | 2026-08-10 | lab: pcap-field-kit |
| tailscale up command | 2026-08-10 | 09 The platform matrix |
| tailscale.com/client/local package reference | 2026-08-11 | recipe: your-program-is-the-node |
| tailscale.com/disco package source | 2026-08-10 | lab: magicsock-guided-read |
| tailscale/tailscale cmd/containerboot (tailscaled arguments) | 2026-08-10 | drill: docker-node-multiplies |
| tailscale/tailscale control/controlclient/direct.go | 2026-08-10 | drill: ephemeral-node-vanished, lab: reading-go-for-investigation |
| tailscale/tailscale GitHub repository | 2026-08-10 | 00 The shape of Tailscale, 02 The control plane, 12 The codebase, lab: reading-go-for-investigation |
| tailscale/tailscale health/warnings.go | 2026-08-10 | drill: key-expiry-outage, drill: ephemeral-node-vanished |
| tailscale/tailscale LICENSE (BSD-3-Clause) | 2026-08-10 | lab: reading-go-for-investigation |
| tailscale/tailscale net/netcheck/netcheck.go | 2026-08-10 | drill: udp-blocked, lab: reading-go-for-investigation |
| tailscale/tailscale README | 2026-08-10 | lab: reading-go-for-investigation |
| tailscale/tailscale tailcfg/tailcfg.go | 2026-08-10 | drill: works-then-drops |
| tailscale/tailscale tsnet/tsnet.go source | 2026-08-11 | recipe: your-program-is-the-node |
| tailscale/tailscale version/prop.go (macOS bundle identifiers) | 2026-08-10 | drill: macos-flap |
| tailscale/tailscale wgengine/magicsock package | 2026-08-10 | lab: magicsock-guided-read |
| tailscale/tailscale wgengine/magicsock/magicsock.go | 2026-08-10 | drill: works-then-drops, lab: magicsock-guided-read, lab: reading-go-for-investigation |
| tailscale/tailscale, wgengine/filter/filter.go | 2026-08-10 | drill: acl-one-way-ping |
| tailscale/tailscale, wgengine/router/osrouter/router_linux.go | 2026-08-10 | drill: route-not-approved |
| tailscaled | 2026-08-10 | 09 The platform matrix |
| tailscaled debug server source (cmd/tailscaled/debug.go) | 2026-08-10 | lab: pprof-field-kit |
| tailscaled flags and default TUN names (cmd/tailscaled/tailscaled.go) | 2026-08-10 | lab: pcap-field-kit, lab: pprof-field-kit |
| tailscaled LocalAPI handler source (ipn/localapi/localapi.go) | 2026-08-10 | lab: pprof-field-kit |
| tailscaled LocalAPI pprof handler source (ipn/localapi/pprof.go) | 2026-08-10 | lab: pprof-field-kit |
| Three ways to run Tailscale on macOS | 2026-08-10 | 00 The shape of Tailscale, 09 The platform matrix, drill: macos-flap, craft: evidence-collection |
| Troubleshooting guide | 2026-08-10 | drill: macos-flap, craft: live-incident-craft, craft: evidence-collection |
| tsnet | 2026-08-11 | 08 Exposing services, recipe: your-program-is-the-node |
| tsnet example: tshello | 2026-08-11 | recipe: your-program-is-the-node |
| tsnet example: tsnet-funnel | 2026-08-11 | recipe: your-program-is-the-node |
| tsnet package, tailscale/tailscale repository | 2026-08-10 | 08 Exposing services |
| User approval | 2026-08-10 | 04 Identity and auth |
| Using Tailscale with other VPNs | 2026-08-10 | 09 The platform matrix, drill: magicdns-vpn-conflict |
| wgengine/magicsock/derp.go | 2026-08-10 | lab: magicsock-guided-read |
| wgengine/magicsock/endpoint.go | 2026-08-10 | lab: magicsock-guided-read |
| wgengine/magicsock/peermap.go | 2026-08-10 | lab: magicsock-guided-read |
| wgengine/magicsock/relaymanager.go | 2026-08-10 | lab: magicsock-guided-read |
| What firewall ports should I open to use Tailscale? | 2026-08-12 | 00 The shape of Tailscale, 11 Troubleshooting and observability, drill: exit-node-slow, drill: udp-blocked, drill: works-then-drops, lab: pcap-field-kit, craft: repro-construction, recipe: vms-born-on-the-tailnet, lab: stand-up-a-relay-you-control, lab: where-does-your-traffic-actually-go, lab: both-sides-shouting-neither-hearing |
| What happens if the coordination server is down? | 2026-08-10 | 02 The control plane |
| What is 100.100.100.100? | 2026-08-10 | 06 MagicDNS and split DNS, 11 Troubleshooting and observability, drill: magicdns-vpn-conflict, drill: split-dns-leak |
| What is a tailnet | 2026-08-10 | 00 The shape of Tailscale |
| wireguard-go message sizes, Tailscale fork (device/noise-protocol.go) | 2026-08-10 | lab: pcap-field-kit |
| wireguard-go protocol constants, Tailscale fork (device/constants.go) | 2026-08-10 | lab: pcap-field-kit |
| WireGuard: Next Generation Kernel Network Tunnel | 2026-08-10 | drill: works-then-drops |
| Wireshark display filter reference, WireGuard (wg) | 2026-08-10 | lab: pcap-field-kit |
| Workload identity federation | 2026-08-10 | 04 Identity and auth |
| Workload identity federation GA blog post | 2026-08-10 | 04 Identity and auth |
138 sources on ledger.