Re: [BEHAVE] RFC6147 and RFC7208 interoperability issues

[Christian Huitema <[e-mail]>]

On 2/9/2022 11:07 PM, marcelo bagnulo braun wrote:

> El 7/2/22 a las 19:03, Christian Huitema escribió:
>>
>>
>> On 2/6/2022 10:34 PM, marcelo bagnulo braun wrote:
>>> El 7/2/22 a las 3:48, Klaus Frank escribió:
>>>> The DNS64 server could be this secure DNS.
>>>
>>> This would consistent with the deployment scenario presented in 
>>> section 7.1 of RFC6147. 
>>
>>
>> Maybe. But the situation has changed since April 2011. ISPs cannot 
>> any more assume that all hosts will be using the resolver embedded in 
>> the NAT64 gateway -- some hosts, or some applications, may very well 
>> use some alternate encrypted DNS service, e.g., using DoH and connect 
>> to Quad9, Cloudflare or Google. The cases describe in section 6 of 
>> RFC6147 are going to be more and more frequent. We should make them 
>> work, and we should tell application developers about that.
>>
> DNS64 doesnt have to be collocated withthe NAT64 box.
>
> The scenario 7.1 still holds in case the user is using an external 
> reoslver, such as cloudflare. The thing is that the external resolver 
> must then implement the DNS64.

How does the external resolver know when it should implement DNS64 and 
when it shouldn't?

> This works fine as long as the WKP is used. 

Lot's of stuff will work better if the WKP is used...

-- Christian Huitema