{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/tailscale-tailnet-lock-signing-disablement-recovery/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/",
        "slug": "tailscale-tailnet-lock-signing-disablement-recovery",
        "url": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/tailscale-tailnet-lock-signing-disablement-recovery/"
        },
        "title": "Prepare signing-node and disablement recovery before enabling Tailnet Lock",
        "summary": "Tailnet Lock moves admission authority onto trusted nodes and creates a separate recovery dependency.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:17+00:00",
        "modified_at": "2026-10-15T13:36:16+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 266,
        "potentially_affected": "This is a planning guide for Tailnet Lock, not a command sequence to enable it on a production network. Check current plan eligibility and supported client versions before scheduling a change.",
        "dse_recommendation": "DSE recommends assigning separate custodians to signing nodes and recovery material.",
        "primary_source": {
            "name": "Tailscale — Tailnet Lock",
            "url": "https://tailscale.com/docs/features/tailnet-lock",
            "published_on": null,
            "authority": "tailscale.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Tailnet Lock moves admission authority onto trusted nodes and creates a separate recovery dependency.</p>\n<h2>Source facts</h2>\n<p>Tailnet Lock requires new node public keys to be signed by trusted signing nodes before peers accept connections. Tailscale’s setup procedure asks administrators to select at least two signing nodes. Initialization creates disablement secrets that are displayed only at that time; a secret authorizes disabling Tailnet Lock. The documentation warns that losing those secrets without supplying a support disablement option can prevent recovery of the tailnet. Nodes use an initial trust-on-first-use state, and administrators can compare their reported trusted signing keys.</p>\n<p>Source: <a href=\"https://tailscale.com/docs/features/tailnet-lock\">Tailscale — Tailnet Lock</a>.</p>\n<h2>Applicability</h2>\n<p>This is a planning guide for Tailnet Lock, not a command sequence to enable it on a production network. Check current plan eligibility and supported client versions before scheduling a change.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends assigning separate custodians to signing nodes and recovery material. Avoid placing every signing node behind the same operational dependency. Store disablement secrets in approved protected storage with a documented access process, and decide deliberately whether to provide the optional support recovery secret. Record the expected trusted public keys independently of the setup screen. Review how a new node is admitted, how a lost signer is replaced, and how emergency disablement would be authorized before enabling enforcement.</p>\n<h2>Verification</h2>\n<p>Pilot with disposable nodes first. Compare the trusted-key list on participating nodes, admit one intended node through the documented signing flow, and verify that an unsigned node remains excluded. Check that authorized custodians can locate recovery instructions without exposing disablement secrets in ordinary tickets.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://tailscale.com/docs/features/tailnet-lock\">Tailscale — Tailnet Lock</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Tailnet Lock moves admission authority onto trusted nodes and creates a separate recovery dependency.\nSource facts\nTailnet Lock requires new node public keys to be signed by trusted signing nodes before peers accept connections. Tailscale’s setup procedure asks administrators to select at least two signing nodes. Initialization creates disablement secrets that are displayed only at that time; a secret authorizes disabling Tailnet Lock. The documentation warns that losing those secrets without supplying a support disablement option can prevent recovery of the tailnet. Nodes use an initial trust-on-first-use state, and administrators can compare their reported trusted signing keys.\nSource: Tailscale — Tailnet Lock.\nApplicability\nThis is a planning guide for Tailnet Lock, not a command sequence to enable it on a production network. Check current plan eligibility and supported client versions before scheduling a change.\nDSE recommendation\nDSE recommends assigning separate custodians to signing nodes and recovery material. Avoid placing every signing node behind the same operational dependency. Store disablement secrets in approved protected storage with a documented access process, and decide deliberately whether to provide the optional support recovery secret. Record the expected trusted public keys independently of the setup screen. Review how a new node is admitted, how a lost signer is replaced, and how emergency disablement would be authorized before enabling enforcement.\nVerification\nPilot with disposable nodes first. Compare the trusted-key list on participating nodes, admit one intended node through the documented signing flow, and verify that an unsigned node remains excluded. Check that authorized custodians can locate recovery instructions without exposing disablement secrets in ordinary tickets.\nOfficial reference\nTailscale — Tailnet Lock. Reviewed October 15, 2026.",
        "content_markdown": "Tailnet Lock moves admission authority onto trusted nodes and creates a separate recovery dependency.\n\n## Source facts\n\nTailnet Lock requires new node public keys to be signed by trusted signing nodes before peers accept connections. Tailscale’s setup procedure asks administrators to select at least two signing nodes. Initialization creates disablement secrets that are displayed only at that time; a secret authorizes disabling Tailnet Lock. The documentation warns that losing those secrets without supplying a support disablement option can prevent recovery of the tailnet. Nodes use an initial trust-on-first-use state, and administrators can compare their reported trusted signing keys.\n\nSource: [Tailscale — Tailnet Lock](https://tailscale.com/docs/features/tailnet-lock).\n\n## Applicability\n\nThis is a planning guide for Tailnet Lock, not a command sequence to enable it on a production network. Check current plan eligibility and supported client versions before scheduling a change.\n\n## DSE recommendation\n\nDSE recommends assigning separate custodians to signing nodes and recovery material. Avoid placing every signing node behind the same operational dependency. Store disablement secrets in approved protected storage with a documented access process, and decide deliberately whether to provide the optional support recovery secret. Record the expected trusted public keys independently of the setup screen. Review how a new node is admitted, how a lost signer is replaced, and how emergency disablement would be authorized before enabling enforcement.\n\n## Verification\n\nPilot with disposable nodes first. Compare the trusted-key list on participating nodes, admit one intended node through the documented signing flow, and verify that an unsigned node remains excluded. Check that authorized custodians can locate recovery instructions without exposing disablement secrets in ordinary tickets.\n\n## Official reference\n\n[Tailscale — Tailnet Lock](https://tailscale.com/docs/features/tailnet-lock). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/",
                "url": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Prepare signing-node and disablement recovery before enabling Tailnet Lock",
                        "item": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/#article",
                "identifier": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/",
                "url": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/",
                "headline": "Prepare signing-node and disablement recovery before enabling Tailnet Lock",
                "description": "Tailnet Lock moves admission authority onto trusted nodes and creates a separate recovery dependency.",
                "abstract": "Tailnet Lock moves admission authority onto trusted nodes and creates a separate recovery dependency.",
                "articleBody": "Tailnet Lock moves admission authority onto trusted nodes and creates a separate recovery dependency.\nSource facts\nTailnet Lock requires new node public keys to be signed by trusted signing nodes before peers accept connections. Tailscale’s setup procedure asks administrators to select at least two signing nodes. Initialization creates disablement secrets that are displayed only at that time; a secret authorizes disabling Tailnet Lock. The documentation warns that losing those secrets without supplying a support disablement option can prevent recovery of the tailnet. Nodes use an initial trust-on-first-use state, and administrators can compare their reported trusted signing keys.\nSource: Tailscale — Tailnet Lock.\nApplicability\nThis is a planning guide for Tailnet Lock, not a command sequence to enable it on a production network. Check current plan eligibility and supported client versions before scheduling a change.\nDSE recommendation\nDSE recommends assigning separate custodians to signing nodes and recovery material. Avoid placing every signing node behind the same operational dependency. Store disablement secrets in approved protected storage with a documented access process, and decide deliberately whether to provide the optional support recovery secret. Record the expected trusted public keys independently of the setup screen. Review how a new node is admitted, how a lost signer is replaced, and how emergency disablement would be authorized before enabling enforcement.\nVerification\nPilot with disposable nodes first. Compare the trusted-key list on participating nodes, admit one intended node through the documented signing flow, and verify that an unsigned node remains excluded. Check that authorized custodians can locate recovery instructions without exposing disablement secrets in ordinary tickets.\nOfficial reference\nTailscale — Tailnet Lock. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:17+00:00",
                "dateModified": "2026-10-15T13:36:16+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/tailscale-tailnet-lock-signing-disablement-recovery/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Prepare signing-node and disablement recovery before enabling Tailnet Lock"
                },
                "articleSection": [
                    "Business Continuity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Business Continuity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 266,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Tailscale — Tailnet Lock",
                    "url": "https://tailscale.com/docs/features/tailnet-lock"
                }
            }
        ]
    }
}