[DNSOP] Re: [v6ops] Re: Re: Re: Moving DNS64 (RFC6147) to Internet Standard

[Philip Homburg <[e-mail]>]

> > IPv6 and DNSSEC are independent technologies. We cannot assume that one
> > implies the other.
> 
> And do you have real experience of deployments breaking it? I will
> love to see those cases.

You never installed a DNSSEC validating proxy on a laptop without CLAT?

> I think the point is to understand that DNSSEC with DNS64 is broken
> only in a very very very small % of situation, which can also be
> resolved.

The problem with DNS64 is that it seems to work (to some extent at least)
without CLAT. But as soon as you install a DNSSEC validating proxy,
or some other DNSSEC validation, access to IPv4 is lost.

The same thing is of course true for a DNS proxy that connects to a 
public resolver over DoH or DoT.

That means that devices that rely on DNS64 make it is a lot harder to
deploy those technologies.