IME some web security gateways block the Tailscale domains entirely, presumably because it's a VPN that can bypass said gateway.