alert dns $HOME_NET any -> any any (msg:"ET INFO Tailscle DERP Relay Server in DNS Query"; dns.query; content:"derp"; startswith; content:".tailscale.com"; fast_pattern; nocase; endswith; pcre:"/derp\d+[a-z]?\x2etailscale.com/"; reference:url,tailscale.com/docs/reference/derp-servers; classtype:misc-activity; sid:2071638; rev:1; metadata:created_at 2026_08_20, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, updated_at 2026_08_20;)