IPv6 only iterative resolver utilising NAT64

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 8 April 2023.¶

Copyright Notice

Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

This document describes how an IPv6-only iterative resolver can use NAT64 [NAT64] to connect to an IPv4-only authoritative server by performing IPv4 to IPv6 translation [RFC6052]. When a specific DNS zone is only served by an IPv4-only authoritative server (which has only an A record), an IPv6-only iterative resolver cannot resolve that zone due to having no access to an IPv4 network. However, by performing IPv4 to IPv6 translation and utilizing the NAT64, accessing an IPv4-only authoritative server will be possible.¶

2. Terminology

• Iterative resolver: A DNS server that repeatedly makes non-recursive queries and follows referrals and/or aliases. The iterative resolution algorithm is described in Section 5.3.3 of [RFC1034]¶
• IPv6-only iterative resolvers: Iterative resolvers that only have IPv6 connectivity.¶
• IPv6/IPv4 translator: A device that translates IPv6 packets to IPv4 packets and vice versa. It is only required that the communication initiated from the IPv6 side be supported.¶
• IPv4-only authoritative server: An authoritative server with only IPv4 connectivity, or an authoritative server with only an A record registered so it can only be accessed by IPv4.¶

3. Motivation and Problem Solved

Over the past decade, IPv6 capabilities have been widely deployed, and IPv6 traffic is growing faster than IPv4 traffic. An overview of IPv6 deployment status and how network operators are implementing IPv6 is provided by the document [ietf-v6ops-ipv6-deployment]. Most IPv6 deployments as of 2022 use a dual-stack strategy [RFC4213]. However, the deployment of IPv6-only networks is also in progress, as demonstrated by [draft-XIE-v6ops-framework-md-ipv6only-underlay]. By operating an IPv6-only network and limiting IPv4 reachability to NAT64 devices, operators can reduce IPv4 usage and concentrate on IPv6 operations, which is generally believed to lower operational costs and optimize operations compared to a dual-stack environment.¶

An iterative resolver is one of the applications that require IPv4 connectivity. As stated in BCP91 [RFC3901], "every recursive name server SHOULD be either IPv4-only or dual stack." This is because some authoritative servers do not support IPv6. As of 2022, even some of the most frequently queried authoritative servers cannot be accessed via IPv6. Without the utilization of NAT64, IPv6-only recursive resolvers need to forward queries to a dual-stack recursive name server performing the iterative queries.¶

The current situation where an iterative resolver cannot be operated without IPv4 reachability may hinder the operation of a network's own iterative resolver in an IPv6-only network. Therefore, this document describes how iterative resolvers can be used without issues in IPv6-only networks by utilizing NAT64.¶

The NAT64/DNS64 mechanism enables IPv6-only clients in a network to communicate with remote IPv4-only nodes. However, using literal IPv4 addresses instead of DNS names will fail (unless 464XLAT [RFC8683] is used). An iterative resolver cannot use the DNS64 because it is a service that uses literal IP addresses (and also because the DNS64 may depend on the resolver itself). This problem can be solved by the iterative resolver converting IPv4 addresses to IPv6 by adding the Pref64::/n prefix, which instructs the NAT64 to convert the IPv6 packets to IPv4 packets. With this implementation, an iterative resolver can be operated even inside an IPv6-only network.¶

4. Solution with existing protocols

This section provides the mechanism of an IPv6-only resolver utilizing the NAT64. We'll assume we have one or more IPv6/IPv4 translator boxes [NAT64] connecting an IPv6 network to an IPv4 network. The NAT64 device provides translation service and bridges the two networks, allowing communication between IPv6-only hosts and IPv4-only hosts. The IPv6-only resolver proposed in this document performs the IPv4 to IPv6 synthesis for the resolver to communicate with IPv4 servers via NAT64. By using NAT64, this IPv6-only iterative resolver can be considered dual stack in the sense of [RFC3901].¶

5. Deployment Notes

TODO¶

            +---------------------+         +---------------+
            |IPv6 network         |         |    IPv4       |
            |           |  +-------------+  |  Internet     |
            |           |--| Name server |--|               |
            |           |  | with DNS64  |  |  +----+       |
            |  +----+   |  +-------------+  |  | H2 |       |
            |  | H1 |---|         |         |  +----+       |
            |  +----+   |   +------------+  |  192.0.2.1    |
            |           |---| IPv6/IPv4  |--|               |
            |           |   | Translator |  |               |
            |           |   +------------+  |               |
            |           |         |         |               |
            +---------------------+         +---------------+

            +---------------------+         +---------------+
            |IPv6 network         |         |    IPv4       |
            |           |     +--------+    |  Internet     |
            |           |-----| Name   |----|               |
            | +-----+   |     | server |    |  +----+       |
            | | H1  |   |     +--------+    |  | H2 |       |
            | |with |---|         |         |  +----+       |
            | |DNS64|   |   +------------+  |  192.0.2.1    |
            | +----+    |---| IPv6/IPv4  |--|               |
            |           |   | Translator |  |               |
            |           |   +------------+  |               |
            |           |         |         |               |
            +---------------------+         +---------------+

      +--------------------------+         +----------------------+
      | IPv6 network             |         |    IPv4              |
      |                          |         |  Internet            |
      |                          |         |                      |
      | +----------+             |         |  +--------------+    |
      | |IPv6-only |   |         |         |  |Authoritative |    |
      | |Iterative |   |         |         |  |server        |    |
      | |resolver  |---|   +------------+  |  +--------------+    |
      | +----------+   |---| IPv6/IPv4  |--|  192.0.2.1           |
      |                |   | Translator |  |                      |
      |                    +------------+  |                      |
      |                          |         |                      |
      +--------------------------+         +----------------------+

6. Security Considerations

TODO Security¶

Write about DNSSEC Validators and DNS64.¶

This algorithm does not alter any part of the DNS message but only changes the packet type from IPv4 to IPv6 and the destination IP Address from an IPv4 address to the synthesized IPv6 address, so there shouldn't be any problems with DNSSEC.¶

7. IANA Considerations

This document has no IANA actions.¶

8. Implementation Status

TODO: write this part and mail BIND.¶

Bind has an WIP branch.¶

https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6334/commits¶

Unbound has a PR from a contributor. https://github.com/NLnetLabs/unbound/issues/721¶

Acknowledgments

TODO acknowledge people.¶

Thank you for reading this draft.¶

Authors' Addresses