Re: [dns-dir] Help reviewing draft-ietf-opsec-ipv6-implications-on-ipv4-nets for bad DNS advice?

On Jul 5, 2013, at 8:00 PM, Ted Lemon wrote:

> This is a document about how to disable IPv6 on corporate networks, for those who swing that way.   The bit of text I am concerned with is this:
> 
>   For this reason, networks attempting to prevent IPv6 traffic from
>   traversing their devices should consider configuring their local
>   recursive DNS servers to respond to queries for AAAA DNS records with
>   a DNS RCODE of 0 (NOERROR) [RFC1035] or to silently ignore such
>   queries, and should even consider filtering AAAA records at the
>   network ingress point to prevent the internal hosts from attempting
>   their own DNS resolution.  This will ensure that hosts which are on
>   an IPv4-only network will only receive DNS A records, and they will
>   be unlikely to attempt to use (likely broken) IPv6 connectivity to
>   reach their desired destinations.
> 
> This looks like bad advice to me.   I'm not convinced that there is a safe way to do what is proposed here.   What do you all think?

Safe in what sense? Are there security dangers in it?

I can state a lot of reasons why I don't *like* it:

- Please just deploy IPv6 instead
- Users that want to get around this, can (8.8.8.8)
- Inconsistency in DNS is hard to diagnose, troubleshoot, etc....

That said, 6to4 and Teredo are as rampant as they are broken. Perhaps the focus should be on ridding these from codebases entirely rather than pussyfooting around about it as we have in the past. 

- Mark

> 
> The complete document is here:
> 
> 	http://tools.ietf.org/html/draft-ietf-opsec-ipv6-implications-on-ipv4-nets-05
> 
> Thanks!
> 
> _______________________________________________
> dns-dir mailing list
> dns-dir@ietf.org
> https://www.ietf.org/mailman/listinfo/dns-dir