I'm fortunate to get native IPv6, so I'm not very familiar, tho I think I have basic understanding.
Did you mean you need to pick just one of {authoritative DNS server, DNS64} to listen on port 53? No, because the authoritative DNS only needs to be accessible from the outside. Run it on another machine or nonstandard port, then expose via port forwarding. Machines in LAN don't need direct access to the authoritative DNS server, they can just as well resolve via the regular system.
Oh, now I see.
I guess then the DNS64 server needs to do the dnssec verification on behalf of the user, then drop the RRSIG records for the v4->v6 translated names.
Oh, and now I realize I confused the direction. DNS64 makes v4 into v6.
dihutenosa@piefed.social 1 month ago
I'm fortunate to get native IPv6, so I'm not very familiar, tho I think I have basic understanding.
Did you mean you need to pick just one of {authoritative DNS server, DNS64} to listen on port 53? No, because the authoritative DNS only needs to be accessible from the outside. Run it on another machine or nonstandard port, then expose via port forwarding. Machines in LAN don't need direct access to the authoritative DNS server, they can just as well resolve via the regular system.
possiblylinux127@lemmy.zip 1 month ago
DNS translates IPv4 addresses to IPv6 NAT64 addresses for networks that are IPv6 only
I believe that DNSSEC breaks it since the IP addresses will be different.
dihutenosa@piefed.social 1 month ago
Oh, now I see.
I guess then the DNS64 server needs to do the dnssec verification on behalf of the user, then drop the RRSIG records for the v4->v6 translated names.
Oh, and now I realize I confused the direction. DNS64 makes v4 into v6.
possiblylinux127@lemmy.zip 1 month ago
What is the security benefit of DNSSEC?
It made more sense when everything was http now https is the norm is is less useful as far as I can tell.