Jun 8; 2025$$$Tailscale v1.84.2$$$Windows$$$This release is signed with a new code signing certificate. The certificate subject and issuer remain unchanged; but the certificate has a new serial number.

May 20; 2025$$$Tailscale v1.84.0$$$$$$All platforms$$$The --reason flag is added to the tailscale down command.$$$ReconnectAfter policy setting; which configures the maximum period of time between a user disconnecting Tailscale and the client automatically reconnecting.$$$Tailscale CLI commands throw an error if multiple of the same flag are detected.$$$Network connectivity issues when creating a new profile or switching profiles while using an exit node.$$$$$$Windows$$$AlwaysOn.Enabled and AlwaysOn.OverrideWithReason policy settings; which enable and configure a Tailscale client mode where the client stays connected at all times; unless an exception applies.$$$When Always On mode is enabled; Tailscale connects as soon as a user signs in to the device and stays connected; regardless of whether the GUI is running. This enables access to tailnet resources; such as network-mapped drives; earlier in the sign-in process; and can also be used on headless Windows environments.$$$EnableDNSRegistration policy setting; which configures whether Tailscale IP addresses should be registered with Active Directory DNS.$$$The Tailscale GUI starts for all signed-in users when the client is installed.$$$DNS-over-TCP fallback works correctly with upstream servers reachable only via the tailnet.$$$Issue where the Tailscale GUI would not start if the client was installed via Group Policy or mobile device management (MDM) while a user was already signed in.$$$Issue where the Tailscale GUI did not auto-start after a client update.

Mar 25; 2025$$$Tailscale v1.82.0$$$All platforms$$$DERP functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use Lets Encrypt or WebPKI certificates.$$$Go is updated to version 1.24.1$$$NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available; in the event of a slow or misbehaving server.$$$Captive portal detection reliability is improved on some in-flight Wi-Fi networks; including British Airways and WestJet.$$$Port mapping success rate is improved by retrying in additional error cases.$$$$$$More details - https://tailscale.com/changelog#client

Mar 25; 2025$$$Tailscale v1.82.0$$$All platforms$$$DERP functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use Lets Encrypt or WebPKI certificates.$$$Go is updated to version 1.24.1$$$NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available; in the event of a slow or misbehaving server.$$$Captive portal detection reliability is improved on some in-flight Wi-Fi networks; including British Airways and WestJet.$$$Port mapping success rate is improved by retrying in additional error cases.$$$$$$More details - https://tailscale.com/changelog#client

Feb 12; 2025$$$Tailscale v1.80.2$$$Update instructions$$$All platforms$$$Nodes could lose the display names of owners of peers in rare cases. This had manifested in missing names in tailscale status and could prevent incoming Tailscale SSH connections from being accepted. The behavior is reverted to that of v1.78.x and earlier.$$$Linux$$$SSH clients that skip the none auth method and immediately try publickey can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.$$$macOS$$$SSH clients that skip the none auth method and immediately try publickey can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.$$$FreeBSD$$$SSH clients that skip the none auth method and immediately try publickey can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.

Dec 4; 2024$$$Tailscale v1.78.1$$$Update instructions$$$All platforms$$$Issue which resulted in an unwanted change in source code line endings.

Nov 5; 2024$$$Tailscale v1.76.6$$$Update instructions$$$Note: v1.76.4 and v1.76.5 were internal-only releases.$$$$$$All platforms$$$Logging for when clients move home DERP regions is improved.$$$Tailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.$$$Android$$$Android app no longer terminates unexpectedly when performing network transitions.

Oct 20; 2024$$$Tailscale v1.76.3$$$Update instructions$$$Note: v1.76.3 includes fixes for Windows devices only; and is exclusively released for Windows.$$$$$$Windows$$$Mullvad VPN submenu no longer fails to populate with Mullvad exit nodes if there arent any non-Mullvad exit nodes in the tailnet.

Oct 15; 2024$$$Tailscale v1.76.1$$$Update instructions$$$All platforms$$$tailscale netcheck CLI command no longer crashes when performing diagnostics on networks lacking UDP connectivity.$$$Improperly formatted SERVFAIL responses no longer cause DNS timeouts when using an exit node.$$$Linux$$$dbus login sessions no longer fail on systems where /bin/login is missing.$$$Android$$$Android application no longer crashes in certain configurations when editing the app-based split tunneling settings.

Tailscale v1.76.0$$$Update instructions$$$All platforms$$$Clients lacking UDP connectivity no longer skip performing fallback latency measurements with DERP servers.$$$Warnings no longer display unnecessarily.$$$Tailscale connectivity on in-flight internet on airplanes (such as Alaska Airlines) no longer fails.$$$Service-related processes no longer run unnecessarily when services are disabled on the tailnet.$$$Error messages include explanations in addition to the HTTP status code.

Sep 11; 2024$$$Tailscale v1.74.0$$$Update instructions$$$All platforms$$$AuthKey system policy can be used to authenticate a device with Tailscale using an MDM solution.$$$tailscale dns CLI command is added for accessing Tailscale DNS settings and status.$$$Go is updated to version 1.23.1.$$$Tailnet Lock long rotation signatures are truncated automatically to avoid excessive growth.$$$Log In option in the client works as expected.$$$Linux$$$TCP generic receive offload (GRO) support is added for improved userspace mode throughput.$$$TCP generic segmentation offload (GSO) is re-introduced for supporting improved userspace mode throughput. This was initially introduced in Tailscale v1.72.0 and then rolled back in v1.72.1.$$$Windows$$$The client no longer connects to a tailnet automatically when restarting or switching profiles.$$$Profiles created as Local System with Unattended Mode enabled are retained after a reboot.$$$macOS$$$The open-source variant of the Tailscale client can now read the system DNS configuration to provide DNS resolution when tailscale set -—accept-dns or tailscale up -—accept-dns is enabled and the Override local DNS option in the DNS page of the admin console is disabled.$$$DNS resolution continues to work after a key expires.$$$tvOS$$$The ping feature allows you to observe connectivity performance between your Apple TV and other devices in your tailnet.$$$Android$$$Tailscale DNS works as expected when switching between Wi-Fi and cellular networks.$$$System policies for the Android client on ChromeOS work as expected.

Aug 19; 2024$$$Tailscale v1.72.0$$$Update instructions$$$All platforms$$$Captive portal detection is now supported.$$$The tailscale cert command now contains the --min-validity flag. Use this flag to request a specified minimum remaining validity on the returned certificate. This flag is intended for automation; like cron jobs; that periodically refreshes certificates.$$$The tailscale lock command now supports passing keys as files. To pass a key as a file; use the prefix file: followed by the path to the file: file:<path-to-key-file>.$$$A health warning is now raised if Tailscale is unable to forward DNS queries to the configured resolvers.$$$An increase in send and receive buffer sizes for userspace mode TCP improves throughput over high latency paths.$$$Linux$$$The addition of TCP generic segmentation offload (GSO) support to userspace mode improves throughput.

Jul 17; 2024$$$Tailscale v1.70.0$$$Update instructions$$$All platforms$$$Restrict recommended and automatically selected exit nodes using the new AllowedSuggestedExitNodes system policy. Applies only to platforms that support system policies.$$$Improved NAT traversal for some uncommon scenarios.$$$Optimized sending firewall rules to clients more efficiently.$$$Exit node suggestion CLI command now prints the hostname (which you can use with the tailscale set command).$$$Taildrive share paths configured through the CLI resolve relative to where you run the tailscale command.$$$Linux$$$Switching from unstable to stable tracks using the tailscale update command now works correctly.$$$Windows$$$Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.$$$The new AllowedSuggestedExitNodes system policy restricts which exit nodes Tailscale recommends or automatically selects.$$$DNS leak issue.$$$Switching from unstable to stable tracks using the tailscale update command now works correctly.$$$Taildrive server no longer starts unnecessarily when no drives are configured.$$$macOS$$$Note: As previously announced; Tailscale v1.70 is the last version to support macOS 10.15 Catalina. macOS 10.15 is no longer supported by Apple and no longer receives security updates. Users still running macOS 10.15 should update to a newer version of macOS to continue receiving security updates and new features.$$$$$$Toggle Tailscale DNS from Siri or the Shortcuts app.$$$Receive health notifications in the client menu on macOS to inform you about lack of internet connectivity; firewalls blocking Tailscale; misconfiguration issues; and other issues. Health issues that affect connectivity also change the Tailscale icon in the system menubar to show an exclamation mark.$$$On MacBooks with a notch in the display; a notification window will now appear if the Tailscale icon is hidden behind the notch due to too many menubar items.$$$The Tailscale client now warns you when the built-in macOS content filter (Screen Time) prevents Tailscale from connecting.$$$Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.$$$The exit node picker no longer presents exit node suggestions if the organization enforces always using the suggested exit node using the ExitNodeID system policy.$$$Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.$$$Taildrive server no longer starts unnecessarily when no drives are configured.$$$Increased the reliability of the Install Updates Automatically setting.$$$iOS$$$Toggle Tailscale DNS from Siri or the Shortcuts app.$$$Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.$$$wireguard-go memory pool deadlock issue is resolved.$$$Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.$$$User interface no longer flickers when selecting an exit node.$$$tvOS$$$Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.$$$wireguard-go memory pool deadlock issue is resolved.$$$User interface no longer flickers when selecting an exit node.$$$Android$$$Access ping information and connection status by long-pressing on a device in the devices list and selecting Ping.$$$Use split tunneling to force or exclude app traffic through your tailnet.$$$wireguard-go memory pool deadlock issue is resolved.

Jul 2; 2024$$$Tailscale v1.68.2$$$Update instructions$$$All Platforms$$$Tailnet lock validation of rotation signatures now permits multiple nodes signed by the same pre-signed reusable auth key.$$$macOS$$$Wake from sleep reliability is improved for re-connections and transitions between networks.$$$iOS$$$Wake from sleep reliability is improved for re-connections and transitions between networks.

Jun 14; 2024$$$Tailscale v1.68.1$$$Update instructions$$$All Platforms$$$4via6 subnet router advertisement works as expected.$$$Linux$$$Tailscale SSH access to Security-Enhanced Linux (SELinux) machines works as expected.

Tailscale v1.68.0$$$Update instructions$$$All Platforms$$$Auto-updates are available for containers. The tailnet-wide default is ignored in containers.$$$When enabled; auto-updates get applied even if the node is down or disconnected from the coordination server.$$$tailscale lock status now prints the nodes signature.$$$Go is updated to version 1.22.4.$$$Windows$$$ installer no longer downloads MSI packages for Windows 7 and Windows 8; automatically. See the v1.42.0 changelog for our initial end of life announcement.$$$macOS$$$Standalone variant of the client can now install a launcher for the Tailscale CLI in /usr/local/bin by going to Settings; CLI integration; then Show me how.$$$Standalone variant of the client now supports notifications when a file is received using Taildrop.$$$Pop-up notification displays when a network might be vulnerable to a potential TunnelVision attack. For more information; see TunnelVision vulnerability and Tailscale.$$$Client starts up more reliably if another VPN app is running when Tailscale is enabled.$$$.pkg installer terminates pre-existing copies of Tailscale and the VPN extension before proceeding with installation if Tailscale was already installed.$$$TunnelBear installation is properly detected; and warns the user about incompatibility.$$$Using Exit Node label no longer appears incorrectly in the app menu before completing onboarding; upon the first time app launch.$$$Fixed a bug with split DNS domains being used as search domains after a network change.$$$iOS$$$Battery life is optimized by offloading DNS resolution to iOS in more cases.$$$Client now starts more reliably if another VPN app is running when Tailscale is enabled.$$$Bug report view no longer copies the bug report ID to the clipboard automatically.$$$Reauthenticate button for in-app key expiry notifications works as expected.$$$Dark mode contains minor changes to UI colors.$$$Fixed a bug with split DNS domains being used as search domains after a network change.$$$tvOS$$$Client now starts more reliably if another VPN app is running when Tailscale is enabled.$$$Reauthenticate button for in-app key expiry notifications works as expected.$$$Android$$$On-off toggle state better matches the actual client state.$$$Status notifications when Tailscale is disconnected are now background notifications; and tapping on notifications launches the Tailscale app.$$$Client starts automatically after the first login.$$$System policy (MDM) support is added for mandatory exit nodes.$$$Organization name is now rendered properly when set in the ManagedByOrganizationName system policy.$$$Crashing no longer occurs when launching Tailscale and another VPN application was already running.$$$Running an exit node no longer lets you use another device as an exit node and vice versa.$$$Home screen shows the selected exit node country and city when using Mullvad exit nodes.$$$Note: The Tailscale client releases for containers such as the Kubernetes operator; Docker image; and tsrecorder are typically released a few days after the initial client release. A separate changelog will be published when client updates for containers are available.

May 20; 2024$$$Tailscale v1.66.4$$$Update instructions$$$All platforms$$$Restored UDP connectivity through Mullvad exit nodes.$$$Linux$$$Stateful filtering is now off by default. Stateful filtering was introduced in 1.66.0 as a mitigation for a vulnerability described in TS-2024-005; and inadvertently broke DNS resolution from containers running on the host. Most vulnerable setups are protected by other mitigations already; except when autogroup:danger-all is used in ACLs.

Tailscale v1.66.3$$$Update instructions$$$Note: Tailscale v1.66.2 was an internal-only release.$$$$$$All platforms$$$Login URLs did not always appear in the console when running tailscale up.

v1.66.0$$$We recommend updating all Tailscale clients to v1.66.0 or later to benefit from additional security improvements.$$$$$$All platforms$$$Implemented client-side quarantining for shared-in exit nodes; as a mitigation for a security vulnerability described in TS-2024-005.

v1.64.2 Latest$$$Windows$$$Changed: Installers are now built using WiX toolchain version 3.14.1.

v1.62.1 Latest$$$$$$Windows$$$Fixed: Do not allow msiexec to reboot the operating system

29 February 2024$$$Tailscale v1.60.1$$$Update instructions ?$$$$$$ALL PLATFORMS$$$Exposing port 8080 to other devices in your tailnet works as expected

Jan 23; 2024$$$Tailscale v1.58.2$$$Update instructions ?$$$Note: The 1.58.1 release needed to be re-done. Use 1.58.2 instead.$$$$$$ALL PLATFORMS$$$App connectors have improved scheduling and merging of route changes under some conditions$$$Crash when performing UPnP portmapping on older routers with no supported portmapping services$$$MACOS$$$Opening the About window no longer displays a user interface when there is no newer version

Dec 20; 2023$$$HTTPS certificates GA$$$HTTPS certificates GA (generally available)$$$Use HTTPS certificates to provision TLS certificates for devices in your tailnet$$$View machine certificate status$$$View the TLS certificate status of a machine in your tailnet by using the Machines page of the admin console$$$Dec 15; 2023$$$Tailscale v1.56.1$$$Update instructions ?$$$LINUX$$$Web interface redirects to the correct self-IP known by the source peer$$$App connector domain list displays as expected$$$MACOS$$$Custom login server uses the provided URL instead of login.tailscale.com$$$IOS$$$Custom login server uses the provided URL instead of login.tailscale.com$$$TVOS$$$Custom login server uses the provided URL instead of login.tailscale.com

Oct 2; 2023$$$Tailscale v1.50.1$$$Update instructions ?$$$ALL PLATFORMS$$$tailscale serve configuration doesn’t persist in container (#9558)$$$tailnet lock fails to sign node in container (#9539)$$$Funnel doesn’t work for tsnet apps (#9566)$$$UPnP potentially crashes in specific circumstances