Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, an expired Tailscale device key stops that device from making or receiving tailnet connections. If the expired device is your Pi-hole, or a subnet router that your clients use to reach your DNS, the knock-on effect can look like a whole-network outage. Whether your entire network actually went dark depends on how your clients were configured to reach Pi-hole, and that is the part you should check first.
This article explains what the 180-day expiry does, why one stalled server can break name resolution everywhere, how to recover, and when it makes sense to turn expiry off for an always-on machine. The outage described here is a reported personal experience. The Tailscale and Pi-hole behavior below comes from their official documentation.
What the 180-day number actually controls
Tailscale requires devices to reauthenticate periodically. Its key-expiry documentation says the default node-key expiry for new domains is 180 days, and that tailnet settings can change that default. Tailscale’s own wording on the consequence is direct:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“If reauthentication does not occur, keys expire and connections to/from the given endpoint will stop working.”
#1 Best Overall
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
The key that matters for a self-hosted server is the device node key, not the auth key you used to join the machine. The two are easy to confuse:
| Credential | Lifetime | What happens when it expires |
|---|---|---|
| Auth key | Chosen when the key is generated, up to 90 days (Tailscale documentation, accessed October 7, 2026) | It stops being usable for new joins. A device already authorized with it stays authorized until its node key expires. |
| Device node key | 180 days by default for new domains (Tailscale key-expiry documentation, last validated January 5, 2026) | Connections to and from that device stop working until it reauthenticates or its expiry is changed. |
So the expiry you hit was almost certainly the node key of the machine running Pi-hole or routing for your network. Check the expiry date for that specific machine in the admin console rather than assuming the default applies to your tailnet.
Why one expired server can break a whole network
Pi-hole is a DNS sinkhole, and it usually works by being the resolver your router hands out. Pi-hole’s post-install guidance describes configuring router DHCP so that clients receive Pi-hole as their DNS server. Once that is in place, every client on the network sends its lookups to Pi-hole.
Recommended Free Tools
Rank #2
- Vilros Complete Starter Kit for Pi 4 Includes Raspberry Pi 4 Model B Board and all the accessories you need to get started.
- 9-PART KIT WILL HAVE YOU READY TO GET UP AND RUNNING: Kit Includes 1. Raspberry Pi 4 Model B Board 2. Case With Easy to connect Built-in fan 3. 64GB Micro SD card Preloaded with RP OS 4. Vilros Pi 4 Compatible Power Supply with Inline on/off switch (power supply color may vary white/black) 5. Micro HDMI to Standard HDMI cable (5ft) 6. Micro SD to USB adapter to reflash card if desired 7. Neoprene Storage Bag to store all parts when not in use 8. Set of 4 Heatsinks 9. Vilros QuickStart Guide instruction booklet for Pi 4
- PASSIVE & ACTIVE COOLING: The included case is well-vented and the kit also includes a set of heatsinks with thermal stickers for easy application and a pre-installed fan to keep the board cool in any use.
- CONVENIENT ACCESSORIES: The power supply features an inline on/off switch neoprene bag that holds and protects all the parts when not in use and the QuickStart guide is updated and written for Raspberry Pi 4.
- IMPORTANT: Kit does NOT include Keyboard, Mouse or Monitor
Now consider where Pi-hole is reachable from. If your clients reach it only over the tailnet, for example because the Oracle VM is the only place Pi-hole runs, an expired node key cuts off name resolution for those clients. Tailscale’s expiry blocks the connection to that endpoint, so a device that is still online can no longer ask it for names.
Two details decide how big the outage is:
- Fallback resolvers. If clients receive a second DNS server through DHCP, or can fall back to one, they may keep resolving names. If the only resolver is the expired machine, many apps fail at once, which looks like the whole network is down.
- Name versus address. A client can often still reach a server by IP address while name lookups fail. If pinging a known IP works but browsing by name does not, the problem is DNS, not general connectivity.
If Pi-hole runs on your local network and never depended on the tailnet, an expired key on a separate cloud VM would not take it down. The reported outage is consistent with the tailnet-dependent layout, but public documentation cannot confirm the author’s exact topology.
Connector routes can fail without warning
Connectors add a second failure mode. If a Tailscale machine acts as a subnet router or exit-node connector, its advertised routes can stay configured on client devices after the connector’s key expires. The routes still appear in place, but the connector can no longer serve them.
Rank #3
- KEEP YOUR PROCESSOR COOL: The busier a processor gets the more it heats up, leading to sub-optimal performance. To prevent this common issue, this kit includes an aluminum alloy case with a pre-installed fan. The aluminum alloy actively draws the heat from the pi board, while the fan further cools the board and case. These cooling mechanisms will help push the limits of your processor and increase its flexibility.
- SIZABLE RAM: This Raspberry Pi 4 comes equipped with 4GB of RAM, which is the same amount of RAM or more RAM than many mainstream laptops contain. With 4GB of RAM, your processor will be capable of running retro gaming setups and common computer applications, media players, and much more!
- SIMPLE TO TURN ON & OFF: This kit includes a USB-C Raspberry Pi 4 compatible power supply with an easy-to-use on/off switch that was designed specifically for the Raspberry Pi 4 model to streamline processing.
- IMPROVEMENTS FROM PREVIOUS MODELS: This latest model of the Raspberry Pi 4 offers groundbreaking increases in processor speed, multimedia performance, connectivity, memory, and more! The desktop performance of this model is comparable to entry-level x86 PC systems.
- VERSATILE USE: The Raspberry Pi may have a small processor, but it is a highly adaptable little computer that can replace your desktop PC. Its functions range from practical to nostalgic since it can power an ad-blocking server as easily as it can power an outmoded gaming setup. Other uses include but are not limited to printing from non-wireless printers, playing media, making time-lapse videos, and building multiplayer network game servers and motion-capture security systems.
Tailscale describes this as a fail-close policy. Routes are kept rather than removed so that traffic is not sent to untrusted networks. The practical result is confusing: the configuration looks correct, and traffic to the subnet silently fails. Tailscale recommends either disabling key expiry for the connector or running it in a high-availability setup so one expired node does not disrupt the routes.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHow to recover from an expired device key
Work through these steps in order. The first option that is available to you is usually the safest.
- Confirm which device expired. Open the Machines page in the Tailscale admin console and find the machine that runs Pi-hole or advertises your subnet. An expired key is shown on that device’s entry.
- Make sure you have a second way in. The recovery command below can drop the tailnet connection. If you are working over SSH or RDP through the tailnet, do not run it until you have console access, a local login, or another route to the machine.
- Reauthenticate from the machine. Run
tailscale up --force-reauth, then complete the login in the browser. Expect the connection to drop briefly. - Or extend the key temporarily from the admin console. An admin can extend an expired device key by 30 minutes. That window is long enough for the operator to reauthenticate or to disable expiry for the device.
- Verify DNS from a client. From a client that was affected, look up a name through Pi-hole’s address directly, for example with
nslookup example.com 192.168.1.10using your Pi-hole’s real LAN or tailnet IP. A successful answer from Pi-hole, followed by normal lookups without the explicit server, confirms the path is back.
Should you disable key expiry?
Disabling expiry is a documented option for a trusted always-on server or subnet router. You can do it from the Machines page in the admin console. Tailscale’s own guidance warns that it reduces security if the device or its key is compromised, so it is a trade-off rather than a default.
Rank #4
- A RASPBERRY PI KIT FROM AN APPROVED RESELLER: Basic Starter Kit for Pi 4 Includes Raspberry Pi 4 Model B Board (4GB) with basic accessories to get started.
- INCLUDES BASIC VITAL ACCESSORIES TO GET STARTED: Eight parts Includes: 1. Raspberry Pi 4 Model B (4GB RAM) 2. ABS 2 Part Snap Assembly Case 3. Raspberry Pi 4 compatible 3A Power Supply with on/off switch 4. Cooling Fan (Preinstalled In case) 5. Standard.HDMI (Female) to Micro HDMI Male Adapter 6. Heatsinks (set of 4) 7.Neoprene Storage bag 8. Vilros Quickstart Guide for Raspberry Pi 4
- RASPBERRY PI 4 MODEL B SPECS: Dim: 85.6mm × 56.5mm–Processor: Broadcom BCM2711, quad-core Cortex-A72 (ARM v8) 64-bit SoC @ 1.5GHz--Memory: 4GB LPDDR4--Connectivity: 2.4 GHz and wireless LAN, Bluetooth, Gigabit Ethernet 2×USB 3.0 ports 2×USB 2.0 ports---GPIO: 40-pin GPIO header---Video & Sound: 2 × micro HDMI ports---Multimedia: H.265 H.264 OpenGL ES, 3.0 graphics SD card support: Micro SD card slot for OS & data---Input power: 5V DC via USB-C connector, 5V DC via GPIO header, POE(requires HAT)
- PASSIVE & ACTIVE COOLING: The kit includes a heatsink with thermal stickers for easy application and if that this not enough you can also connect the pre-installed fan to keep the board cool in any use
- CONVENIENT ACCESSORIES: The power supply features an inline on/off switch neoprene bag that holds and protects all the parts when not in use and the quick start guide is updated and written for Raspberry Pi 4
| Comparison axis | Keep expiry and reauthenticate on schedule | Disable expiry on a trusted server |
|---|---|---|
| Recovery dependency | An expiry date can take the service down unless someone reauthenticates in time | No scheduled reauthentication to miss |
| Security exposure | A stolen key has a limited useful life | A compromised device or key stays trusted until revoked |
| Availability design | A single expired node takes its services and routes offline | Removes this failure, but not hardware or network failures |
| Access to recover | Needs a second access path if reauthentication is needed remotely | Reduces how often you need that path |
For a home Pi-hole that only you use, disabling expiry on the one always-on server is a reasonable choice if you keep that device patched and protect the account that manages it. For a shared or business network, keep expiry on, set a calendar reminder for the expiry date, and consider high availability for any connector that other people depend on.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where Oracle’s free tier fits in
Oracle’s Always Free compute is available for the life of an account, subject to its terms and resource limits. Its documentation describes a monthly VM.Standard.A1.Flex allowance stated as 1,500 OCPU hours and 9,000 GB-hours per month, equivalent for Always Free tenancies to 2 OCPUs and 12 GB of memory.
Oracle also documents reclamation criteria for idle instances. These include CPU and network utilization below 20% at the 95th percentile over a seven-day period, and, for A1 shapes, memory utilization below 20%. A quiet Pi-hole VM can meet those criteria, so reclamation is a real availability consideration to monitor.
Best Value
- Includes Raspberry Pi 4 8GB Model B with 1.5GHz 64-bit quad-core CPU (8GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K 60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
Those rules are separate from key expiry. Nothing in Oracle’s documentation ties reclamation to Tailscale node keys, so the cause of this reported outage should be traced in the Tailscale and Pi-hole logs before blaming the cloud provider.
Checklist for your own setup
- Note the expiry date of every machine that runs DNS or advertises a subnet.
- Confirm whether clients have a DNS server other than Pi-hole, and whether it is reachable when the tailnet is down.
- Keep a non-tailnet way into every remote machine, such as the cloud provider’s console or a local login.
- Decide per machine whether expiry stays on with a reminder, or is disabled because the machine is trusted and always on.
- Check whether the VM is at risk of idle reclamation, and keep a recent copy of your Pi-hole configuration.
The Bottom Line
An expired Tailscale node key can stop a machine’s connections, and if your clients depend on that machine for DNS, the failure will look like a whole-network outage. Keep a second access path, know which machines have expiry dates, and disable expiry only on machines you trust and keep secured.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
