6to4 in Internet aaaa records

[Brian E Carpenter]

On 03/10/2014 15:58, Ca By wrote:
> On Thu, Oct 2, 2014 at 7:47 PM, Jeroen Massar <jeroen at massar.ch> wrote:
> 
>> On 2014-10-02 22:37, Ca By wrote:
>> [..]
>>> Yes, i think .gov requires AAAA records.  So it looks like DNS admins
>>> are generating AAAA records that ultimately break connectivity.
>>>
>>> Back to my question, should there be an RFC generated that advises
>>> network admins to only put native natural addresses in DNS for anything
>>> that is supposed to be production grade and routed across the Internet?
>>>
>>> Meaning:
>>>
>>> 1.  Only make AAAA records from 2000::/3
>> 2002::/16 (6to4) is part of that.
>>
>>> 2.  Do not make AAAA records with 6to4 addresses
>> See http://tools.ietf.org/html/rfc6343

To save looking-up effort, here's what it says:

4.2.4. DNS Issues


   A customer who is intentionally using 6to4 may also need to create
   AAAA records, and the operator should be able to support this, even
   if the DNS service itself runs exclusively over IPv4.  However,
   customers should be advised to consider carefully whether their 6to4
   service is sufficiently reliable for this.

   Operators could, in principle, offer reverse DNS support for 6to4
   users [RFC5158], although this is not straightforward for domestic
   customers.

The point is that if you are crazy enough to rely on 6to4 to offer
IPv6 service, as it seems the people at www.azdes.gov are, you must
of course have a stable 6to4 server and provide a DNS entry,
and a reverse entry (RFC 5158) too. But as the rest of RFC 6343
should tell you, you really would have to be crazy.

I have to say that this deployment seems to be broken in a way
that we didn't even imagine when writing RFC 6343, yet it does
have stable, reliable DNS service ;-).

>> and of course also:
>>  http://tools.ietf.org/html/draft-ietf-v6ops-6to4-to-historic-05
>>  (though that technically expired).

3 years ago that seemed premature. With recent progress in real IPv6,
I'm wondering whether it isn't time to revive it. If so it should be
changed to be a BCP that says "Don't do this" and also makes
the proposed standard drafts Historic.

But we do hear persistently that there are happy hobbyist and peer to peer
users of 6to4. Using it offer web service for the Arizona Department of
Economic Security is so wrong, though.

>>From my reading of RFC6343 it is not clearly stated that one should not
> produce AAAA records with 6to4 addresses.  The wording is unclear IMHO.

No, it is intended to say that if you insist on using 6to4, you *need*
stable DNS service and possibly reverse DNS.

   Brian

> 
>> Except for quick tests, doing anything with 6to4 is futile.
>>
>>
> Fully agree on that, 6to4 is the worst and the fact that it was not made
> historic is a shame.
> 
> 
>> Clearly though in this case the address never worked. Can't fix problems
>> between chair and keyboard with documents.
>>
>>
> Fair
> 
> 
>>> 3.  Do no make AAAA records with NAT64 WKP 64:ff9b::/96 ( saw this last
>>> week )
>> One can stuff whatever one wants in DNS, if it breaks though that is the
>> problem of the operator.
>>
>> Greets,
>>  Jeroen
>>
>>
> 
> There in lies the problem.  I have received escalations in the last few
> days on my eyeball network regarding internet servers with 6to4 in DNS and
> NAT64 WKP in DNS.   In the WKP case, the server operator read the RFCs and
> tried to pursued me to his understanding of those RFCs that i should route
> and support WKP to my NAT64 and that he was doing the right thing by
> putting the WKP as RR in his DNS files.
>