Re: [v6ops] NAT64/DNS64 and DNSSEC

[Philip Homburg <[e-mail]>]

Based on the discussion after Stuart's presenation about IPv6 at Apple.

Assuming NAT64 without 464XLAT, assuming we want local DNSSEC validation.

The way to make it work would be 'bump-in-the-api'. 

One way of doing that, the comes it mind is to have the DNS resolver bypass
any DNS64 by setting the CD bit and then after validation, at the request
of the application synthesize AAAA records from A records based on the
NAT64 prefix.

I guess this is easy enough to add to for example getdns
(https://getdnsapi.net/) One question is how an application would find out
that it is running in a DNS64 environment. Another option is for getdns to
do the probing and enable this option automatically.