Subject: (ngtrans) Re: I-D ACTION:draft-durand-dns-proxy-00.txt

From: Pekka Savola <[email-masked]>
Date: Fri, 5 Oct 2001 23:52:07 +0300 (EEST)

On Thu, 4 Oct 2001 [email-masked] wrote:
> This document describe a DNS lookup proxy to enable IPv6 only
> resolver to query data on IPv4 only server.

Embedding IPv4 address into an anycast prefix has non-trivial security
considerators wrt. different reflector DoS attacks, as noted with 6to4 and
Shipworm.

Based on this and draft-ietf-ngtrans-dns-ops-req-02.txt, I fail to see why
exactly dual-stack DNS servers, as an architectural requirement, not just
one huge server somewhere, could not be enough.

Couldn't you just assume that in a scenario:

host1  -- dns1 -+- dns-DS -- Internet -- dns-anywhere
host2  -- dns2 -'

Assume host1 is IPv6 only.  Dns1 is also IPv6 only.  dns-DS must be
dual-stack.  If dns1 performed all it's queries recursively from dns-DS
there would be no problem here (for example, with BIND I believe this can
be done with 'forward only; forwarders { ... }' settings.

I think this is the case with many enterprise DNS servers;  one might have
a few caching servers deployed in about every LAN, which all talk only
with a few central servers, and the central servers are authorative and
talk to the world.  These central servers would be required to be
dual-stack.

This model assumes the site, or the provider, has one DNS server that can
talk IPv6.  I believe this is a reasonable assumption if you expect
IPv6-only nodes to be even remotely usable.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords