On 16-Feb-22 07:38, Andrew Baker wrote:
You can get IPv6 via a tunnel broker. Hurricane Electric (http://he.net/) is one of the larger ones. You can get a /48 from them - for free. Bandwidth is modest. You can setup reverse zones; they'll delegate. I don't think they support DNSSEC - it's been on their wishlist for years.Firstly, thanks for the advice about the hidden master the other day, that’s now setup, working fine and we’ve just finished transferring about 4500 records across!My software team came up this morning and slapped me across the face with a wet fish (figuratively speaking as It’s not Thursday yet!) by informing me that they are developing a mobile app for one of our companies that Apple have mandated an ipv6 DNS requirement before they publish.At the moment, all our infrastructure from ISP device inwards is ipv4 so setting up the zone on our DNS is going to require a lot of significant changes! There are a couple of things reference all this that I’m unsure about and am hoping you can educate me on.Firstly, we are running bind 9.11 on Debian 10 hosts. * Is it worth use upgrading to Debian 11 to get the newer version of bind? * Are there any issues/bugs/holes in 9.11 that will cause us a problem, especially if we start messing with ipv6? * If I do upgrade the on-premise servers, is it better to do master then slaves or the other way around? * If we have DNSSEC configured, is it going to break anything upgrading? (I have lots of backups of the zones and hosts files) Secondly, reference bind config * For the “listen-on-v6” statement, are the only options still ‘none’ or ‘all’? * Can the “listen-on-v6” only be enabled globally in the ‘named.conf.options’ or is it possible to enable per zone as we are (currently) only going to have 1 zone needing ipv6? * Once ipv6 is enabled. Is it advisable to setup a sub-domain for the ipv6 addresses to avoid dual-stacking?The reverse zones for our ipv4 are handled (badly) by our local telecoms provider. How big an issue is it going to be for ipv6 if the reverse lookups are badly/not implemented?If our ISP can’t give us a public ipv6 address, can we still run our bind to give out ipv6 addresses or not?Finally, can anyone point me towards any good reading on bind configuration and DNS best practice (preferably with idiot proof examples)? I must decide fairly quickly if we roll this zone back to our domain registrar who is setup to handle ipv6 or do we strike out and bring our DNS setup up to date and future proofed!Thanks for your time and expertise. Andy Baker **
I use 9.11 (and have used previous) versions of bind with IPv6 - no IPv6 issues.
Zones have nothing to do with dual stack. If you create an AAAA record, your host can be found via IPv6. If you create an A record, IPv4. Both gives you "dual stack". I tend to create x.v[46].example.net style names in addition to x.example.net for cases where I want one or the other. This doesn't require a zone - it's just a name.
One reason to not configure your host with both A and AAAA records may be that most resolvers will prefer V6, but if you have a tunnel for V6 & a wide pipe to your ISP, you may find that you're connecting thru the tunnel & limited by its bandwidth.
There is no requirement for named to listen on IPv6 for it to serve AAAA records. That's orthogonal, and dependent on what the resolver(s) can live with.
HE has a lot of IPv6 educational materials (not bind-specific) that are quite good.
Depending on where you are in the world, there are other brokers. I switched to HE when SiXXS went out of business and have been happy. I have no other connection to HE. YMMV.
DNSSEC doesn't care what transport protocol is used or what records are served. It just signs them. Moving, you do need to make sure that the keys and delegations are present on the receiving end. Once the move is complete, it may be a good time to do a key roll.
Finally, it's not clear from your note how you're setup, but if you run your own servers, you need to meet the geographic dispersion rules. At least 2 servers in two places. That's true no matter what protocols you use. There are backup DNS services that support IPv6. A free one that supports both IPv6 and DNSSEC is puck.nether.net/dns.
There are plenty of DNS books/guides. I'll let someone else do the reviews. Timothe Litt ACM Distinguished Engineer -------------------------- This communication may not represent the ACM or my employer's views, if any, on the matters discussed.
OpenPGP_signature
Description: OpenPGP digital signature
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
