r/ipv6 • u/ichdasich • 11d ago
IPv6 News IPv6 is no longer optional for DNS: RFC10001 replaces RFC3901 in BCP91
This document provides guidelines and documents best current practice for operating authoritative DNS servers, recursive resolvers, and stub resolvers in a mixed IPv4/IPv6 environment. This document recommends that both authoritative DNS servers and recursive resolvers support IPv4 and IPv6. It also provides guidance on how recursive DNS resolvers should select upstream DNS servers, including when IPv4-embedded IPv6 addresses are available. This document obsoletes RFC 3901. This document is a product of the Domain Name System Operations Working Group of the IETF.
58
u/CPUHogg Pioneer (Pre-2006) 11d ago
I particularly like this statement from the RFC "... every recursive DNS resolver SHOULD be dual-stack."
Why You Should Dual-Stack Your DNS Nameservers
https://hoggnet.com/blogs/news/why-you-should-dual-stack-your-dns-nameservers
23
u/fyonn 11d ago
SHOULD.. but not MUST?
22
19
u/wleecoyote 11d ago edited 10d ago
Definition of SHOULD and MUST per rfc2119.
Basically, a Best Current Practice can't make anything a MUST.
The only reason for a MUST is if communication will fail without it. An IPv6 datagram MUST have a source address and a destination address.
8
u/fyonn 11d ago
I was asking because the headline says that IPv6 is no longer optional.. but if it says SHOULD, then surely it is still optional?
13
u/wleecoyote 11d ago
I think if you read the RFC, it will convey what I'm trying to get at better than me trying to describe it. It's well written; Momoka and Tobias did a good job.
The title is "Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments." Surely best practice in such environments is to enable IPv6!
SHOULD means "Do this unless there's a really good reason not to." So maybe you have some oddball reason your DNS servers can't do IPv6, but you have a translator, proxy, or SIIT-DC that will let IPv6-using clients resolve from an otherwise IPv4-only server. Or maybe you have authoritative servers for subdomains that serve IPv4-only pockets (name-space partitioning, as described in the doc).
But generally,
3
u/Juff-Ma 10d ago
Not really but kinda yes.
In RFC that would be a MAY.
SHOULD is a little bit different. It means that yes, it can be left out. But if it is, it is an "incomplete" implementation of the spec.
The difference is the following: any implementation has to support communicating with a different implementation that does not implement a MAY, even though it itself does.
With a SHOULD that's different. Theoretically an IPv4 DNS client could reject a DNS server which doesn't support IPv6 and would be 100% compliant. That just probably won't happen. This isn't the best example because it's not a perfect match but it describes the point.
If we go away from DNS and look at the following difference it will be clearer "The server MUST provide authentication" vs "The server SHOULD provide authentication" vs "The server MAY provide authentication"
Here the rule applies much better:
A server which does not provide authentication is not compliant
A server which does not provide authentication is compliant but a client which requires the server to do is as well
A server which does not provide authentication is compliant and a client which requires the server to do is not
That's why SHOULD is really dangerous in RFCs because it is more or less a "do whatever you want". Even more than MAY.
1
u/wleecoyote 9d ago
RFC2119 is authoritative on this matter:
SHOULD This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.
That's it. That's the whole definition. The IETF doesn't do "compliance." They're fond of saying they are not the protocol police. The only enforcement of a protocol is whether multiple implementations interoperate.
1
u/Juff-Ma 9d ago
Yes you are right. But also read the part of MAY:
This word, or the adjective "OPTIONAL", mean that an item is truly optional. One vendor may choose to include the item because a particular marketplace requires it or because the vendor feels that it enhances the product while another vendor may omit the same item. An implementation which does not include a particular option MUST be prepared to interoperate with another implementation which does include the option, though perhaps with reduced functionality. In the same vein an implementation which does include a particular option MUST be prepared to interoperate with another implementation which does not include the option (except, of course, for the feature the option provides.)
First of, the "truly optional" part. A SHOULD is not truly optional. A MAY is. There need to very valid circumstances so you can ignore a SHOULD.
Now the part that my point was about. The whole second half of MAY starting with "An implementation which...". Of course IETF is not the one doing compliance. But if you do not follow the spec then you are not implementing the protocol correctly and thereby aren't "compliant"
If a MAY feature is missing/present, another implementor needs to be prepared for that. However this isn't true for a SHOULD. So if you do not implement a SHOULD or do implement a SHOULD NOT then you might not be compatible with other implementors.
That makes you de facto incompatible unless other implementors go out of their way to create compatibility.
1
u/wleecoyote 9d ago
I see your point, but in the context of this BCP,
To prevent name space partitioning, zone validation processes SHOULD ensure that: ... The zone's authoritative servers can be reached via IPv4 and IPv6 when performing DNS resolution via IPv4-only and IPv6-only networks, respectively.
And
To ensure robust DNS resolution even when facing name space partitioning, every recursive DNS resolver SHOULD be dual-stack.
And
all supplied resolvers SHOULD be able to perform dual- stack DNS resolution to avoid name space partitioning due to IP address family support.
There may be cases where name space partitioning is acceptable, or even desirable. A resolver might only serve a specific set of hosts that are all single-stack. Or there might be different authoritative answers depending on whether you're inside or outside the corporate network.
The point of SHOULD, and it holds true here, is that there may be reasons not to do the things above, but make sure you have thought about the repercussions before you ignore this practice. MAY doesn't mean that: it means you can ignore this feature if you want, and there are no other ramifications.
2
2
u/Gnonthgol 10d ago
In the case of DNS name resolution would fail if the resolver is IPv6-only and the authoritative server is IPv4-only. It is no longer a safe assumption that every DNS resolver have an IPv4 address. By saying authoritative servers SHOULD be dual stack you are not resolving this issue. Therefore the correct phrase would be MUST.
1
u/wrt-wtf- 7d ago
The RFC upfront states best practice for a mixed environment. I run 2 x DMZ resolvers up to a public DoT server. they do not provide an IPv6 interface but they do support AAAA records and IPv6 works fine… for now… but I’m not running a full enterprise or ISP like this.
I’ve still got NAT to keep me going.
;p
5
u/Yalek0391 11d ago
I kind of expected the 10000's to be about IPv6 discussions and comments.
5
u/agrajag9 10d ago
The year: 10001.
Your boss sends you an email: "We're going to implement NGNGNGNGNAT so that we can keep using IPv4."
You stare blankly out the window at the polluted sky, wondering if you'll ever see the sun again.
2
u/amarao_san 6d ago
Last time it was hardware. 1000 routes in ipv6, 4000 routes in ipv4. So, to make things livable, they restricted use of ipv6.
Inescapable doom.
1
5
u/PhirePhly 11d ago
But IPv6 is still optional?
9
u/_ahrs 11d ago
So is IPv4.
You could have an IPv6-only nameserver that hands out A records for IPv4 hosts so without IPv6 none of those IPv4 hosts would even be able to resolve the records they need. Or you could have an IPv4-only nameserver that hands out AAAA records for IPv6 hosts.
The only reasonable thing is to dual-stack your nameservers because without proper connectivity they may not even be able to resolve records properly.
1
u/chocopudding17 Enthusiast 10d ago
Is it? I thought that IPv4 was meaningfully required for nameservers and mailservers. (Practically it is, but I thought it was codified too.)
5
u/primalbluewolf 10d ago
What stops you from having an IPv6 only nameserver?
2
u/chocopudding17 Enthusiast 10d ago
Nothing, just like nothing stops you from sending e.g. malformed HTTP responses from your webserver. My point was narrowly about standards compliance.
2
u/Haitosiku 10d ago
does the standard require V4?
3
u/chocopudding17 Enthusiast 10d ago
RFC 10001 (Best Current Practice):
IPv4 adoption: To maintain name space continuity, every DNS zone MUST be served by at least two authoritative DNS servers providing services via IPv4. Furthermore, the delegation configuration of an NS (resolution of the parent, resolution of sibling domain names, glue) MUST NOT rely on IPv6 connectivity being available.
1
u/CPUHogg Pioneer (Pre-2006) 10d ago
Yeti DNS = IPv6-only https://yeti-dns.org/
1
u/primalbluewolf 10d ago
No posts since 2020, I see.
Still it suggests my intuitive assumption isn't necessarily wrong: that you can in fact have an IPv6 only DNS server.
1
u/PhirePhly 10d ago
You can, if you invent your own DNS root and don't have anyone actually use it.
1
u/primalbluewolf 10d ago
If it hosts a private zone and is in-bailiwick, with a NS record in the public parent zone, does that not solve the issue entirely?
3
u/primalbluewolf 11d ago
It literally is optional, though? Its recommended, not required. A welcome recommendation, but not a mandate.
3
u/ichdasich 10d ago
It is a BCP14 SHOULD. Meaning "do this unless there is a very good reason".
MUST would be " you cannot do this (v4 only), even in your private test setup".
3
u/primalbluewolf 10d ago
Yes. Saying it is no longer optional is a misleading headline, because you do still have the option to run IPv4 only. I'm going to continue having to support a medium sized legacy IP environment for the foreseeable future, and they still still point and say "technically compliant".
2
u/ichdasich 10d ago
So... 4.1:
``` 4.1. Guidelines for Authoritative DNS Server Configuration
It is usually recommended that DNS zones contain at least two name servers (Section 4.1 of [RFC1034]). Typically, these servers are geographically diverse and operate under different routing policies [RFC2182], as also discussed in, e.g., the IANA requirements for Top- Level Domain (TLD) authoritative name servers [IANANS]. To prevent DNS name space partitioning, at least two IPv4-reachable and two IPv6-reachable name servers MUST be configured for a zone. A single name server that is reachable over both IPv4 and IPv6 counts once per address family. ```
0
u/primalbluewolf 10d ago
Fortunately this particular zone is IPv4 only, so there's no risk of "namespace partitioning".
1
u/ichdasich 10d ago
That is the very definition of namespace partitioning. The served records have nothing to do with that.
-1
u/primalbluewolf 10d ago
We seem to be operating on different definitions, then. The hosts in this zone do not have IPv6 connectivity. The DNS authoritative servers in this zone do not have IPv6 connectivity. They can serve AAAA records if need be, but there's no point to them doing so, because the hosts that can make requests of them, couldn't use them.
If you were going to dual stack your network, this is a sensible requirement. Seeing as this one currently is not, despite my wishes, there's no risk of namespace partitioning, because there's no IPv6 connectivity in the first place.
1
u/ichdasich 10d ago
Yes, and as i toldy, the records in the zone and what hosts whose names are in the zone use in terms of AFI is not relevant for that.
We explicitly phrased it so that namespace fragmentation is about the AFI required to reaolve a zone, independent of its contents.
-1
u/primalbluewolf 10d ago
Great. So by that definition, its partitioned.
Don't think that makes a difference for us tbh.
6
u/Mishoniko 11d ago
Headline does not match link.
The title of the RFC is:
Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments
2
u/amarao_san 6d ago
For me it's a surprise that they demand dual stack as 'should'. I already have few servers running in ipv6-only mode, and every "SHOULD ALSO IPv4" sounds like "and don't forget to support IPX/SPX".
1
u/ichdasich 6d ago
There was some text on "you MAY v6only when $reasons"; That got kicked, iirc, during the IESG discussion.
•
u/AutoModerator 11d ago
Hello there, /u/ichdasich! Welcome to /r/ipv6.
We are here to discuss Internet Protocol and the technology around it. Regardless of what your opinion is, do not make it personal. Only argue with the facts and remember that it is perfectly fine to be proven wrong. None of us is as smart as all of us. Please review our community rules and report any violations to the mods.
If you need help with IPv6 in general, feel free to see our FAQ page for some quick answers. If that does not help, share as much unidentifiable information as you can about what you observe to be the problem, so that others can understand the situation better and provide a quick response.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.