Re: [DNSOP] [v6ops] [IANA #989438] ipv4only.arpa's delegation should be insecure.

[Philip Homburg <[e-mail]>]

>https://tools.ietf.org/html/draft-cheshire-sudn-ipv4only-dot-arpa 
><https://tools.ietf.org/html/draft-cheshire-sudn-ipv4only-dot-arpa>

>From Section 6.2:
3.  Name resolution APIs and libraries MUST recognize 'ipv4only.arpa'
       as special and MUST give it special treatment.  Regardless of any
       manual client DNS configuration, DNS overrides configured by VPN
       client software, or any other mechanisms that influence the
       choice of the client's recursive resolver address(es) (including
       client devices that run their own local recursive resolver and
       use the loopback address as their configured recursive resolver
       address) all queries for 'ipv4only.arpa' and any subdomains of
       that name MUST be sent to the recursive resolver learned from the
       network via IPv6 Router Advertisement Options for DNS
       Configuration [RFC6106] or via DNS Configuration options for
       DHCPv6 [RFC3646].

First we introduce ipv4only.arpa as a hack to avoid creating/deploying a
suitable mechanism to communicate the NAT64 translation prefix. That's fine
with me.

But when that hack then requires changes to every possible DNS stub resolver
implementation in the world, there is something seriously wrong.

So if this in indeeed required to make RFC7050 work then it is better to
formally deprecate RFC7050 and focus on other ways to discover the
translation prefix.

It seems that at least one already exists (RFC7225) so not much is lost.