Re: [BEHAVE] RFC6147 and RFC7208 interoperability issues

[Klaus Frank <[e-mail]>]

On 2022-02-10 08:38, marcelo bagnulo braun wrote:
> El 10/2/22 a las 8:27, Christian Huitema escribió:
>>
>> On 2/9/2022 11:07 PM, marcelo bagnulo braun wrote:
>>
>>> El 7/2/22 a las 19:03, Christian Huitema escribió:
>>>>
>>>>
>>>> On 2/6/2022 10:34 PM, marcelo bagnulo braun wrote:
>>>>> El 7/2/22 a las 3:48, Klaus Frank escribió:
>>>>>> The DNS64 server could be this secure DNS.
>>>>>
>>>>> This would consistent with the deployment scenario presented in 
>>>>> section 7.1 of RFC6147. 
>>>>
>>>>
>>>> Maybe. But the situation has changed since April 2011. ISPs cannot 
>>>> any more assume that all hosts will be using the resolver embedded 
>>>> in the NAT64 gateway -- some hosts, or some applications, may very 
>>>> well use some alternate encrypted DNS service, e.g., using DoH and 
>>>> connect to Quad9, Cloudflare or Google. The cases describe in 
>>>> section 6 of RFC6147 are going to be more and more frequent. We 
>>>> should make them work, and we should tell application developers 
>>>> about that.
>>>>
>>> DNS64 doesnt have to be collocated withthe NAT64 box.
>>>
>>> The scenario 7.1 still holds in case the user is using an external 
>>> reoslver, such as cloudflare. The thing is that the external 
>>> resolver must then implement the DNS64.
>>
>> How does the external resolver know when it should implement DNS64 
>> and when it shouldn't?
>>
>
> I would assume that the external resolver provider makes public which 
> resolver instances implement DNS64 and which do not and the clients 
> select accordingly?
>
Exactly, just look for yourself:

Cloudflare:
* https://developers.cloudflare.com/1.1.1.1/ipv6-networks
* https://developers.cloudflare.com/1.1.1.1/setup-1.1.1.1/linux

Google:
* https://developers.google.com/speed/public-dns/docs/dns64
* https://developers.google.com/speed/public-dns/docs/using

> I guess another alternative would be for the resolver to do dns64 for 
> cusotmers connecting through IPv6 and obtain replies that return only 
> A RR, but this sounds like a bad idea to me....
>
>
>>> This works fine as long as the WKP is used. 
>>
>> Lot's of stuff will work better if the WKP is used...
>>
>> -- Christian Huitema
>>
>
> _______________________________________________
> Behave mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/behave