[DNSOP] Re: [v6ops] Re: Re: Re: Re: Moving DNS64 (RFC6147) to Internet Standard

"jordi.palet@consulintel.es" <jordi.palet@consulintel.es> Wed, 15 April 2026 07:17 UTC

Return-Path: <prvs=15655df082=jordi.palet@consulintel.es>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6517EDC914DA; Wed, 15 Apr 2026 00:17:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1776237427; bh=w3p+txvaxB262ifM58YyTxSDETnjB3bjMnq6sVzWk5E=; h=From:Subject:Date:In-Reply-To:Cc:To:References; b=NflTo8MbvinoXYyR1xKPo7uBGEY1+rt26iuX1q7k0uFbXmIggpQXlzsBFxW6Di0mf ZuCf1/0uuvUlUCJQ3ni3gp86K5o4iga7G8ZTax5uoUkEl8Z3nWS3dAm1vw6UR8X4UE XfzQLBP177dsryZSvLr1elFJUN5sDH1jJql1S3c4=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=consulintel.es
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hH1tZjVNisRE; Wed, 15 Apr 2026 00:17:06 -0700 (PDT)
Received: from mail.consulintel.es (mail.consulintel.es [IPv6:2001:470:1f09:495::5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C90EDDC91212; Wed, 15 Apr 2026 00:14:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=consulintel.es; s=mailer; t=1776237291; x=1776842091; i=jordi.palet@consulintel.es; q=dns/txt; h=From:Message-Id: Content-Type:Mime-Version:Subject:Date:In-Reply-To:Cc:To: References; bh=K7auuA6qd+l95GrA7zLsh15gpblDrmotfO6p70AX2dc=; b=X 7nkC9NGrqWuw8FK/BlVVsouayJsI4tL060EFz7/Fv+IcLyQ8PBfGwLmjt2N6ac6a lCArNUxFmpUXdvmx+mTb18SKsb4NI8PdrjvpFU6MR77kvrGXDeOafw9D2QEVvvKM KK0gz41QT9h9EoHjpFKonuEohd4L15/miS4yNTe4eyanfpnEAuoHGBUSd+ht1e/H gGf2Ve7w5ZB0YGTMGa7iCWaHt0Ue1tpwsnwj9IJbBnZPcp+sGDx4Nu0EshdAMinx Bzs2TkVLYLJaN4zIcDfNB7Le0qMvxLBrhR++vnksTntsiSuN1I0yaohw5Lrt0AIo pWgthHqHJd4tQr+buPvug==
X-MDAV-Processed: mail.consulintel.es, Wed, 15 Apr 2026 09:14:51 +0200 (not processed: message from trusted source)
X-Spam-Processed: mail.consulintel.es, Wed, 15 Apr 2026 09:14:51 +0200
Received: from smtpclient.apple by mail.consulintel.es (10.10.10.5) (MDaemon PRO v25.5.0) with ESMTPSA id md5001002625454.msg; Wed, 15 Apr 2026 09:14:51 +0200
X-MDRemoteIP: 2001:470:1f09:495:e0fe:ac36:ffd9:f836
X-MDArrival-Date: Wed, 15 Apr 2026 09:14:51 +0200
X-Authenticated-Sender: jordi.palet@consulintel.es
X-Return-Path: prvs=15655df082=jordi.palet@consulintel.es
X-Envelope-From: jordi.palet@consulintel.es
From: "jordi.palet@consulintel.es" <jordi.palet@consulintel.es>
Message-Id: <7EA69CE4-0475-493E-8991-D0A5BE3C5779@consulintel.es>
Content-Type: multipart/alternative; boundary="Apple-Mail=_BD574676-41AC-4EED-82A4-B49019E1EB68"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.500.181\))
Date: Wed, 15 Apr 2026 09:14:39 +0200
In-Reply-To: <f08f9b0b-52bd-487d-93a5-6f41e0a3da68@gmail.com>
To: dnsop@ietf.org
References: <1133413B-3A85-40E8-9692-38EA538CD4AD@isc.org> <E2A431EF-B50C-48B0-966F-DB5771264685@isc.org> <f08f9b0b-52bd-487d-93a5-6f41e0a3da68@gmail.com>
X-Mailer: Apple Mail (2.3864.500.181)
X-MDCFSigsAdded: consulintel.es
Message-ID-Hash: 4XRNDHHLREP7OQMTMXZ7U3S4NCURVJQ7
X-Message-ID-Hash: 4XRNDHHLREP7OQMTMXZ7U3S4NCURVJQ7
X-MailFrom: prvs=15655df082=jordi.palet@consulintel.es
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: IPv6 Operations <v6ops@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: [v6ops] Re: Re: Re: Re: Moving DNS64 (RFC6147) to Internet Standard
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/B0ULkdmxfefZdMYOsK5RpX5y7CM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

Hi Brian,

I think almost every protocol can be harmful if incorrectly implemented or deployed … what we may improve in every protocol (and in the case of DNS64) is an applicability statement, how is best implemented/deployed, etc.

What Mark indicates here, if I got it correctly, is in part related to DNS deployment in general and in the previous email to RFC1918 addresses. Being fixed already.

Saludos,
Jordi

@jordipalet


> El 15 abr 2026, a las 0:18, Brian E Carpenter <brian.e.carpenter@gmail.com> escribió:
> 
> It seems to me that we need a draft on "DNS64 Considered Harmful".
> 
> Regards/Ngā mihi
>   Brian Carpenter
> 
> On 15-Apr-26 09:20, Mark Andrews wrote:
>> Continuing on:
>> I was using my iPhone as a hot spot and tests that just work when normally work just started falling.  This is all because people interfere with address lookups. We have decades of complaints about people interfering with address lookups.  There was the whole Site Finder snafu.
>> DNS64 “appears” to work because there are still not a lot of zones that are signed and most of them also are IPv6 enabled.  Add to that all the OS vendors that have been slack in deploying DNSSEC on the devices they ship.
>> Now BIND doesn’t do DNS64 as described.  It does an approximation of it.
>> DNS64 isn’t needed anywhere. 464XLAT doesn’t needed it.  Discovery of the prefix doesn’t need it. You can just publish an ip4only.arpa zone with the correct AAAA records.
>> Figuring out how to do DNS64 correctly  automatically is impossible even ignoring DNSSEC.  You just break things.



**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.