Subject: [BEHAVE] RFC 6147 section 5.1.4 help.

From: "Stephan Lagerholm" <[email-masked]>
Date: Mon, 2 May 2011 10:17:11 -0600

I need advise on RFC 6147 section 5.1.4,

The RFC says that:
"A DNS64 implementation SHOULD provide a mechanism to specify IPv6
prefix ranges to be treated as though the AAAA containing them were an
empty answer."

But then a few sentences later it says that:
"When the DNS64 performs its initial AAAA query, if it receives an
answer with only AAAA records containing addresses in the excluded
range(s), then it MUST treat the answer as though it were an empty
answer, and proceed accordingly."

How should that be interpreted?
1. A DNS64 solution SHOULD provide a mechanism to exclude certain ranges
of IPv6 addresses.
2. A DNS64 solution MUST provide a mechanism to exclude certain ranges
of IPv6 addresses.
3. If a DNS64 solution provides a mechanism to exclude certain ranges,
then it MUST treat the answer as empty. But if it doesn't provide a
mechanism, then it doesn't have to treat the answer as empty.

Thanks, Stephan
----------------------------------------------------------------------
Stephan Lagerholm
Senior DNS Architect, M.Sc. ,CISSP
Secure64 Software Corporation, www.secure64.com
Cell: 469-834-3940

---

From: Mark Andrews <[email-masked]>
Date: Tue, 03 May 2011 10:53:36 +1000

In message <[email-masked]>, "Ste
> mechanism, then it doesn't have to treat the answer as empty.

To answer this it is 3.

You have yet to get to the bit about not returning excluded addresses
even if there are no A records to map which goes way too far.  It
is not the nameservers job to protect clients from addresses that
cannot be reached.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]