DNS ownership
Which DNS records Teitunnel may change, and why it asks before touching the rest.
Your DNS is shared with everything else you run, so Teitunnel keeps track of which records it created.
- Every record Teitunnel creates carries a comment,
teitunnel:route=<id>, and is also remembered locally. - Only those records are ever changed or deleted without asking. Removing a route removes its record only if Teitunnel created it.
- Replacing or deleting any other record is shown in the plan, with the existing record, and needs your explicit confirmation.
The Doctor looks for records that point at a tunnel which no longer exists, or at this Mac's tunnel without a route. Those show a Cloudflare error to visitors, and a record left dangling is a subdomain-takeover risk, so it offers to delete them. Fix Safe Issues only ever touches records Teitunnel created.