Please don't put TailScale / TailCat keys in your DNS. IAintShootinMis and I just tested it out and I went from TXT query to SSH access by only knowing the domain.
IAintShootinMis@iaintshootinmis@digitaldarkage.ccI printed out #TailCat s man/help page because I wasn't sure I was believing what I was seeing. This is an extremely useful tool, that runs in user space, can host an ingress point to the entire network that negotiates around firewalls, can host an authentication-less SSH session, and users are encouraged to place the key to this in their public DNS txt records.
What's stopping me from just scraping the web for txt records that are tailcat= ? Nothing. And I'm gonna do it.
— Open image attachment 1 of 1A terminal which reads:
"Anywhere a <tc-addr> argument is accepted, a DNS name whose "tailcat=" TXT record contains one may be used instead:
tailcat ssh example.com"