{"slug":"use-control-d","title":"Use Control D","tags":["tailscale"],"agent_summary":"Last validated: Dec 8, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Use Control D\r\n\r\nLast validated: Dec 8, 2025\r\n\r\n[Control D](https://controld.com/) is a customizable anycast [DNS](https://tailscale.com/docs/reference/dns-in-tailscale) service that blocks malicious threats, unwanted content, trackers, and ads. Tailscale uses Control D with [DNS over HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS) (DoH). You can configure Control D as a [global nameserver](https://tailscale.com/docs/reference/dns-in-tailscale#global-nameservers) to leverage Control D throughout your tailnet. You cannot use Control D as a split DNS server (also known as a [restricted nameserver](https://tailscale.com/docs/reference/dns-in-tailscale#restricted-nameservers)).\r\n\r\nCurrently, Tailscale only shares device hostnames with Control D.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/integrations/control-d\\#prerequisites)\r\n\r\nUsing Control D with Tailscale requires:\r\n\r\n- Tailscale v1.70.0 or later\r\n- A [Control D endpoint](https://docs.controld.com/docs/devices).\r\n\r\n## [Use Control D as a global nameserver](https://tailscale.com/docs/integrations/control-d\\#use-control-d-as-a-global-nameserver)\r\n\r\nUse Control D as a global nameserver to route DNS queries from all devices in your tailnet to Control D.\r\n\r\nIf you configure Control D as a global nameserver, avoid configuring another global nameserver for your tailnet, as this might circumvent privacy and content restrictions enforced by Control D.\r\n\r\nTo add Control D as a global nameserver:\r\n\r\n1. Open the [DNS](https://login.tailscale.com/admin/dns) page of the admin console.\r\n2. Go to **Nameservers**, then select **Add nameserver** \\> **Control D**.\r\n3. Enter the [resolver ID](https://docs.controld.com/docs/devices#setting-up) for your Control D endpoint.\r\n4. Select **Save** to save Control D endpoint as a global nameserver for your tailnet.\r\n5. Select **Override DNS servers** to force devices to use Control D as a global nameserver instead of the locally configured DNS settings.\r\n\r\n## [Use different Control D profiles for different devices](https://tailscale.com/docs/integrations/control-d\\#use-different-control-d-profiles-for-different-devices)\r\n\r\nControl D lets you create multiple profiles (also known as profile IDs) to control access for different types of devices. For example, you can create an administrator Control D profile and a user Control D profile for your devices.\r\n\r\nYou must be using Control D as a global nameserver to use different profiles for different devices.\r\n\r\nTo specify a different profile than the global profile for a specific Tailscale device:\r\n\r\n1. Set up Control D as a global nameserver for your tailnet.\r\n2. Add a `nodeAttrs` section to your [tailnet policy file](https://tailscale.com/docs/features/tailnet-policy-file) and set a `target` for the devices that apply to the Control D profile. You can use tags, users, groups, or `*`.\r\n3. Add an `attr` section with `controld:`, where `` is your Control D Endpoint's unique resolver ID.\r\n\r\nFor example, in your tailnet policy file:\r\n\r\n```json\r\n{\r\n \"grants\": [\"...\"],\r\n \"nodeAttrs\": [\\\r\n {\\\r\n \"target\": [\"user@example.com\", \"tag:server\"],\\\r\n \"attr\": [\\\r\n \"controld:\",\\\r\n ],\\\r\n },\\\r\n ],\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n## [Priority for tagged devices](https://tailscale.com/docs/integrations/control-d\\#priority-for-tagged-devices)\r\n\r\nSince `nodeAttrs` are additive and can apply to multiple devices, you can use priority values to control which Control D profile takes precedence. For example, a single tailnet node might match multiple profiles. One targeting `tag:server`, and another targeting both `tag:server` and `tag:secure-server`.\r\n\r\nIf the `tag:server` profile includes a Control D override, but you want a more specific override for `tag:secure-server`, you can assign a higher priority to that profile. To do this, add a priority suffix `?priority=1` and `?priority=2` (and so on) to the `attr` entries. The higher the priority number, the higher the priority.\r\n\r\nFor example, in these `attr` entries:\r\n\r\n```json\r\n{\r\n \"nodeAttrs\": [\\\r\n {\\\r\n \"target\": [\"tag:server\"],\\\r\n \"attr\": [\\\r\n \"controld:?priority=1\",\\\r\n ],\\\r\n },\\\r\n {\\\r\n \"target\": [\"tag:secure-server\"],\\\r\n \"attr\": [\\\r\n \"controld:?priority=2\",\\\r\n ],\\\r\n },\\\r\n ],\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\nIn the above example, devices with only `tag:server` match the lower priority `` profile. Devices with both `tag:server` and `tag:secure-server` match both profiles, but Tailscale prioritizes `` because of the higher priority.\r\n\r\nTailscale strips the priority suffix before sending the data to Control D.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Use Control D

\n

Last validated: Dec 8, 2025

\n

Control D is a customizable anycast DNS service that blocks malicious threats, unwanted content, trackers, and ads. Tailscale uses Control D with DNS over HTTPS (DoH). You can configure Control D as a global nameserver to leverage Control D throughout your tailnet. You cannot use Control D as a split DNS server (also known as a restricted nameserver).

\n

Currently, Tailscale only shares device hostnames with Control D.

\n

Prerequisites

\n

Using Control D with Tailscale requires:

\n\n

Use Control D as a global nameserver

\n

Use Control D as a global nameserver to route DNS queries from all devices in your tailnet to Control D.

\n

If you configure Control D as a global nameserver, avoid configuring another global nameserver for your tailnet, as this might circumvent privacy and content restrictions enforced by Control D.

\n

To add Control D as a global nameserver:

\n
    \n
  1. Open the DNS page of the admin console.
    2. \n
  2. Go to Nameservers, then select Add nameserver > Control D.
    3. \n
  3. Enter the resolver ID for your Control D endpoint.
    4. \n
  4. Select Save to save Control D endpoint as a global nameserver for your tailnet.
    5. \n
  5. Select Override DNS servers to force devices to use Control D as a global nameserver instead of the locally configured DNS settings.
    6. \n
\n

Use different Control D profiles for different devices

\n

Control D lets you create multiple profiles (also known as profile IDs) to control access for different types of devices. For example, you can create an administrator Control D profile and a user Control D profile for your devices.

\n

You must be using Control D as a global nameserver to use different profiles for different devices.

\n

To specify a different profile than the global profile for a specific Tailscale device:

\n
    \n
  1. Set up Control D as a global nameserver for your tailnet.
    2. \n
  2. Add a nodeAttrs section to your tailnet policy file and set a target for the devices that apply to the Control D profile. You can use tags, users, groups, or *.
    3. \n
  3. Add an attr section with controld:<resolver-uid>, where <resolver-uid> is your Control D Endpoint's unique resolver ID.
    4. \n
\n

For example, in your tailnet policy file:

\n
{\r\n  \"grants\": [\"...\"],\r\n  \"nodeAttrs\": [\\\r\n    {\\\r\n      \"target\": [\"user@example.com\", \"tag:server\"],\\\r\n      \"attr\": [\\\r\n        \"controld:<resolver-uid>\",\\\r\n      ],\\\r\n    },\\\r\n  ],\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Priority for tagged devices

\n

Since nodeAttrs are additive and can apply to multiple devices, you can use priority values to control which Control D profile takes precedence. For example, a single tailnet node might match multiple profiles. One targeting tag:server, and another targeting both tag:server and tag:secure-server.

\n

If the tag:server profile includes a Control D override, but you want a more specific override for tag:secure-server, you can assign a higher priority to that profile. To do this, add a priority suffix ?priority=1 and ?priority=2 (and so on) to the attr entries. The higher the priority number, the higher the priority.

\n

For example, in these attr entries:

\n
{\r\n  \"nodeAttrs\": [\\\r\n    {\\\r\n      \"target\": [\"tag:server\"],\\\r\n      \"attr\": [\\\r\n        \"controld:<resolver-uid-1>?priority=1\",\\\r\n      ],\\\r\n    },\\\r\n    {\\\r\n      \"target\": [\"tag:secure-server\"],\\\r\n      \"attr\": [\\\r\n        \"controld:<resolver-uid-2>?priority=2\",\\\r\n      ],\\\r\n    },\\\r\n  ],\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

In the above example, devices with only tag:server match the lower priority <resolver-uid-1> profile. Devices with both tag:server and tag:secure-server match both profiles, but Tailscale prioritizes <resolver-uid-2> because of the higher priority.

\n

Tailscale strips the priority suffix before sending the data to Control D.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}