Re: IPv6 only host NAT64 requirements?

[Philip Homburg <[e-mail]>]

> Now people here tell me that local validation
> of DNSSEC isn't done for IP4 either and in practice it's not
> deployable. I'd hope that's untrue, but regardless you don't appear
> to be in a worse position with DNS64 than you are without. Either
> you trust a distance recursive resolver to do the validation for
> you, or you do validation yourself (and also the synthesizing of
> IP6 addresses).

For quite a while now, I'm running two applications with local DNSSEC
validation on my laptop.

One is the cz.nic dnssec validator plugin for web browsers. The other is my
own code that uses getdns in ssh to validate SSHFP records.

In both cases, it just works. My conclusion is that wherever I take my laptop,
getdns can do local DNSSEC validation. DNSSEC works. Of course there are issues.
The fragmentation problems Geoff is seeing are real. But in practice it works.

One of the problems with DNSSEC and NAT64 is one way or another you have
to deal with a AAAA response that is not signed.

Without local synthesizing, local DNSSEC validation will fail. With local
synthesizing the local validator has to tell the application 'trust me, I
know what I'm doing'. Even if that's not actually true.