Re: [v6ops] draft-palet-v6ops-nat64-deployment-02 comments

[Fred Baker <[e-mail]>]

On Jun 28, 2018, at 1:14 AM, JORDI PALET MARTINEZ <[e-mail]> wrote:
>>>>  The major advantage of this scenario, using 464XLAT without DNS64, is
>>>>  that the service provider ensures that DNSSEC is never broken.
>>> 
>>>   Yes, but at the cost of IPv6-IPv4 connectivity.
>> 
>>    I suppose in part I'm thinking out loud. But I do think it's important to not trivialize the lack of connectivity in that last case, which I think your current text does. Yes, DNSSEC doesn't work (doesn't validate a signature, and probably doesn't *have* a signature) with a DNS64 IPv4 embedded IPv6 Address. But it doesn't work without one either, because in the case nothing works - there is no connectivity. It's a judgement call, I suppose, but I think it's better to say it than let the installing ISP discover it and wonder what happened.
> 
> -> Understood. I will improve the text to avoid that trivialization. However, I don't agree it doesn't works. What happens is that in that case, the connection in that case is done using the IPv4 stack of both peers (so the dual-stack host behind the CLAT CE, only see an "A" record, so naturally use only that one).

For the dual stack host behind the CLAT, yes. For the IPv6-only host, there is either no connectivity to an IPv4-only host, or it goes through the PLAT and DNSSEC is broken. There remains no connectivity using the signed DNSSEC A record, because the IPv6-only host isn't using it.