[BEHAVE] Some thoughts on DNS synthesis in DNS64, DNS46, and BIH

[Dave Thaler <[e-mail]>]

Thinking about the comments on BIH led me to the following observations.

draft-ietf-behave-dns64 section 5.1.4 ("Special exclusion set for AAAA records")
talks about how to handle the fact that some IPv6 addresses are not actually
usable by IPv6-only hosts, and recommends that the DNS64 be configurable
with a set of prefixes to ignore and synthesize anyway, and not return the
original response but only the synthesized one.  However there's currently
no text in the dns64 document that says that an admin shouldn't configure
::/0 as an exclusion range.

draft-xli-behave-dns46-for-stateless is supposed to be the DNS46 equivalent
of DNS64.  However, it currently doesn't contain any text equivalent to the
above exclusion set.  I think this is in error and it should have similar text
(really it should have minimal diffs from DNS64).   You could have bogus
A records with 127.0.0.1, 169.*, and other bogon ranges just like bogus AAAA records.

So really the possibilities for synthesis are:

a)      Never synthesize if you get any address regardless of validity

b)      Perform some hard-coded exclusions

c)      Perform configurable exclusions

d)      Perform dynamically detected (i.e. autoconfigured or learned) exclusions
based on some not-currently-defined mechanism

The contentious BIH topic is just a special case of dns46, and the same
possibilities apply.   My opinion is that BIH and dns46 should have text
equivalent to dns64 section 5.1.4.

An implementer of any DNS synthesis mechanism (whether DNS64, DNS46,
or the BIH use of DNS46) should just implement the ability to have
configurable exclusions (c in the above list).

The rest of the discussion is then just about guidance to those who configure
such things, and what is or is not appropriate to exclude.  And various
categories exist independent of DNS46 vs DNS64 vs BIH that can be
discussed as to whether they should be excluded by default, are ok
to configure to exclude, or should not be configured exclusions, listed
below in rough order of least-to-most contentious:


*        Addresses that should never appear in DNS or on the wire

*        Addresses that are known to be permanently unreachable (e.g.
net 10, ULA space) from the DNS synthesizer's network

*        Addresses that are observed to be problematic/flaky (maybe 6to4
in some cases?)

*        Addresses that would work but the admin would prefer to avoid
by policy

*        All addresses for a given IP version (which actually might be the
same as one of the previous 3)

-Dave