IPv4-Mapped IPv6 Address used in DNS with AAAA-records

[Nick Hilliard]

Peter Koch wrote on 28/07/2023 11:15:
> While the economic incentives for the case at hand sound 'interesting',
> operationally this could inspire some measurements - in a different
> sphere, like if someone had, say, ads based tooling.

yep, no doubt there's a case to be made about the query load, but 
there's also a case to implement client side measurements here. Whatever 
about the impact of happy eyeballs - which should alleviate a chunk of 
the theoretical blast radius of a misconfig like this - if an 
ipv4-mapped ipv6 address is presented as a reply to a quad-a record, 
then unless there are mitigations in the client resolver code, it will 
appear as a candidate destination address in the tcp stack.  If the 
client host is dual-stacked, or ipv6-single-stacked, then unless there 
are mitigations in the client tcp stack, a tcp connection attempt may be 
made.

I.e. the pathways for this configuration to produce the intended result 
depend on explicit mitigations in either or both of the client resolver 
and the client tcp stack. Good engineering shouldn't depend on quirk 
workarounds.

Nick