From 7f7c967971755746a9e0b4b517af8cb2f2798731 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Sun, 25 Oct 2026 18:53:15 -0700 Subject: [PATCH] docs(networking): add tag:dntls to the Tailscale policy reference --- docs/docs/reference/networking/tailscale-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/docs/reference/networking/tailscale-policy.md b/docs/docs/reference/networking/tailscale-policy.md index dc0e0f7..2db4f23 100644 --- a/docs/docs/reference/networking/tailscale-policy.md +++ b/docs/docs/reference/networking/tailscale-policy.md @@ -44,6 +44,7 @@ and trailing commas. Section syntax is documented in Tailscale's | `tag:subnet-router` | Devices that advertise lab and home subnet routes into the tailnet | `autogroup:admin` | | `tag:sandbox` | Sandbox hosts that accept advertised lab subnet routes | `autogroup:admin` | | `tag:agentcompute` | Durable agentcompute HTTPS service | `autogroup:admin` | +| `tag:dntls` | `dntls` hosts; no tag-specific access rules, so only the `autogroup:admin` → `*:*` rule reaches them | `autogroup:admin` | A tagged device is owned by its tag, not by the user who registered it. Removing a tag from the policy while a device still carries it leaves that device without