Aperture beta is now available. Start building with AI safely in minutes.READ MORE ->

Domain aliases

Last validated:

When you create a Tailscale network (known as a tailnet), the domain of the first user's email address is set as the primary domain. For example, if bob@example.com creates a tailnet, the tailnet's domain will be example.com. If you have users in your identity provider whose email addresses use a different domain (like example.io), you can create a domain alias in the tailnet to allow those users to sign in to the tailnet too. Once you create a domain alias, other tailnets outside your organization cannot use that domain to authenticate.

Domain aliases can only be created for tailnets where users sign in with accounts under a custom domain, such as example.com. Shared domain tailnets, such as those created with @gmail.com addresses, cannot set up domain aliases. Tailnets using GitHub as their identity provider also cannot use domain aliases.

A diagram illustrating that at a company with users under two domains, example.com and example.io, where example.com is the primary domain, users under the example.io domain will only be able to authenticate to the tailnet if example.io is added as a domain alias.

Create a domain alias

You need to be an Owner or Admin of a tailnet to create a domain alias.

  1. Open the Domains page.
  2. Verify the domain that you wish to add as a domain alias.
  3. Once the domain has been successfully verified, select the ellipsis icon menu and select Set as domain alias.
  4. Confirm that you want to enable the domain alias.

Remove a domain alias

You need to be an Owner or Admin of a tailnet to remove a domain alias.

  1. Open the Domains page.
  2. Find the domain alias you wish to remove, select the ellipsis icon menu, then select Remove domain alias.
  3. If there are users associated with the alias, optionally select the checkbox to also delete those users from the tailnet. If you choose not to delete the users, any existing users under that domain will still be able to sign in to the tailnet, but new users under the formerly-aliased domain will not be able to sign in.
  4. Enter the domain name to confirm, then select Remove alias.

Handle legacy domain aliases

If you previously configured a domain alias by working directly with our support team, that alias will show up on the Domains page with a Legacy identifier. While it is not considered actively verified, the domain alias is still active. You can update the verification of this domain alias by selecting the ellipsis icon menu and selecting Verify.

You can also remove legacy domain aliases on the Domains page. This option behaves the same as removing a domain alias for an actively-verified domain name.

Limitations

  • Domain aliases can only be created for tailnets using a custom domain.
  • Domain aliases can not be created for tailnets using GitHub as an identity provider.