Re: [spfbis] RFC6147 and RFC7208 interoperability issues

[John Levine <[e-mail]>]

It appears that Scott Kitterman  <[e-mail]> said:
>OTOH, how long has DNS64 been deployed (I don't know)?  Will it see increased 
>deployment in the future, so this is the leading edge of the issue?

I think DNS64 and NAT64 fall into the category of "nice try". The idea
was that your devices could all be IPv6 only and the complexity would
all be in the NAT and the DNS translator.

But we now know that DNS64 breaks DNSSEC, it breaks SPF, and as Andrew
has pointed out, it likely breaks other stuff too. NAT64 and DNS64 are
probably OK for mobile networks where everything is a client and P2P
servers are discouraged.

But in reality, all devices are dual stacked, and networks use NAT44
to connect to the IPv4 outside world. I have a bunch of servers at
AWS. They all have real IPv6 addrsses and local 10/8 addresses. The
ones that need to be visible from outside have static real IPv4
addresses routed through the NAT (rumor says at least two levels of
NAT.) The others can get a temporary address from the AWS pool while
they are active. What my hosts see is a /16 of 10/8 where I can
activate /24 subnets in different geographic regions.

It works fine. There is no messing with the DNS, DNSSEC works, the
remote IPv4 addresses my servers see are the real ones so if they were
doing SPF, it would work too.

For a long time the IETF desperately tried to pretend that NAT44 was
useless or stupid or didn't exist, and there were a few attempts to
do something that wasn't NAT44.  I think this is one of them.

R's,
John