Re: IPv6 only host NAT64 requirements?

[Brian E Carpenter <[e-mail]>]

On 14/11/2017 14:03, Ole Troan wrote:
> Brian,
> 
>>>>>> I am not optimistic on the demand / need / value of dnssec in any scenario
>>>>>> ....let alone an ipv6-only host validating an ipv4-only dns name. If the
>>>>>> folks operating this service cared, they could operate the server with
>>>>>> signed v6 names.  It is more reasonable in todays internet to asked the
>>>>>> server (lets assume most signed name scenarios are servers) to be setup
>>>>>> right (with v6). There is not a compelling reason why having v6 is
>>>>>> unattainable today for named nodes.
>>>>>
>>>>> DNSSEC is something that works today.
>>>>
>>>> This is not the impression I get from attending IEPG meetings
>>>> and chatting in the corridors at the IETF. Also, we knew throughout
>>>> the development of NAT64/DNS64 that DNSSEC was a major stumbling block.
>>>> I don't think it is a good idea to entangle RFC6434bis with that issue.
>>>
>>> What's the DNSSEC major stumbling block?
>>
>> I pass. Try asking Geogg Huston, for example.
> 
> As far as I understand it, DNSSEC has deployment issues, which are comparable for the DNS64 and non-DNS64 case.
> 
> https://tools.ietf.org/html/rfc6147#section-3
> https://tools.ietf.org/html/rfc7050#section-3

My understanding during the BEHAVE discussions was that
the gymnastics required in the resolver code in a host
were considerably more complex in the NAT64/DNS64 case than
in any other.
 
> But I will leave someone who knows DNS to give a definite answer to that.

Yes, that would be very helpful.

> If I understand what people are telling me correctly, your statement "major stumbling block" is not correct.

It would be nice if you are correct.

    Brian